Analysis

  • max time kernel
    145s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    22-11-2021 11:29

General

  • Target

    56c72444a610c757a3ff81d991681a51c42e5e839dbaeaf15887f075cde83747.exe

  • Size

    3.5MB

  • MD5

    d63d3afed4c1975a7e31906e0e163305

  • SHA1

    b3f4e45ef92c5ec76bfdaeb3a19071db65ddd7c0

  • SHA256

    56c72444a610c757a3ff81d991681a51c42e5e839dbaeaf15887f075cde83747

  • SHA512

    3c92f0cb5e63620919d7ab412741396fb0f65558a621c4328a69a33ada732f80d03548d3cd88734cd4bc038a7b7c240ecfe61a1f56ead387f04c700fe7d6c1be

Malware Config

Extracted

Path

C:\Program Files\7-Zip\rn9D_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: JCuN1os9MGDE Password: geF3ue2JssuFq6PwGBbK To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cggbt files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Hive

    A ransomware written in Golang first seen in June 2021.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56c72444a610c757a3ff81d991681a51c42e5e839dbaeaf15887f075cde83747.exe
    "C:\Users\Admin\AppData\Local\Temp\56c72444a610c757a3ff81d991681a51c42e5e839dbaeaf15887f075cde83747.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\system32\net.exe
      net.exe stop "NetMsmqActivator" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "NetMsmqActivator" /y
        3⤵
          PID:824
      • C:\Windows\system32\net.exe
        net.exe stop "SamSs" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SamSs" /y
          3⤵
            PID:1976
        • C:\Windows\system32\net.exe
          net.exe stop "SDRSVC" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SDRSVC" /y
            3⤵
              PID:288
          • C:\Windows\system32\net.exe
            net.exe stop "SstpSvc" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:300
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "SstpSvc" /y
              3⤵
                PID:1928
            • C:\Windows\system32\net.exe
              net.exe stop "UI0Detect" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1072
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "UI0Detect" /y
                3⤵
                  PID:1572
              • C:\Windows\system32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1328
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:1644
                • C:\Windows\system32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1656
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1704
                  • C:\Windows\system32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1668
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:1696
                    • C:\Windows\system32\sc.exe
                      sc.exe config "NetMsmqActivator" start= disabled
                      2⤵
                        PID:1432
                      • C:\Windows\system32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:1768
                        • C:\Windows\system32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:1968
                          • C:\Windows\system32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:2020
                            • C:\Windows\system32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1176
                              • C:\Windows\system32\sc.exe
                                sc.exe config "VSS" start= disabled
                                2⤵
                                  PID:1576
                                • C:\Windows\system32\sc.exe
                                  sc.exe config "wbengine" start= disabled
                                  2⤵
                                    PID:852
                                  • C:\Windows\system32\sc.exe
                                    sc.exe config "WebClient" start= disabled
                                    2⤵
                                      PID:1632
                                    • C:\Windows\system32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                      2⤵
                                        PID:1132
                                      • C:\Windows\system32\reg.exe
                                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                        2⤵
                                          PID:600
                                        • C:\Windows\system32\reg.exe
                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                          2⤵
                                            PID:1828
                                          • C:\Windows\system32\reg.exe
                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                            2⤵
                                              PID:1612
                                            • C:\Windows\system32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                              2⤵
                                                PID:1928
                                              • C:\Windows\system32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:1404
                                                • C:\Windows\system32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                  2⤵
                                                    PID:1008
                                                  • C:\Windows\system32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1952
                                                    • C:\Windows\system32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:1956
                                                      • C:\Windows\system32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:1712
                                                        • C:\Windows\system32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:2032
                                                          • C:\Windows\system32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:1264
                                                            • C:\Windows\system32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                              2⤵
                                                                PID:1172
                                                              • C:\Windows\system32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                2⤵
                                                                  PID:1684
                                                                • C:\Windows\system32\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:956
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1736
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                      2⤵
                                                                        PID:580
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                        2⤵
                                                                          PID:1972
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                          2⤵
                                                                            PID:440
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                            2⤵
                                                                              PID:1808
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                              2⤵
                                                                                PID:1840
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                2⤵
                                                                                  PID:1748
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                  2⤵
                                                                                    PID:1740
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                    2⤵
                                                                                      PID:760
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                      2⤵
                                                                                        PID:536
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                        2⤵
                                                                                          PID:1724
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                            PID:1892
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:1664
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:1644
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:1692
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:1256
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                    • Modifies security service
                                                                                                    PID:912
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                      PID:1520
                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                      vssadmin.exe delete shadows /all /quiet
                                                                                                      2⤵
                                                                                                      • Interacts with shadow copies
                                                                                                      PID:288
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl system
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1640
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl security
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1080
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl application
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1976
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic.exe SHADOWCOPY /nointeractive
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1344
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic.exe shadowcopy delete
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1624
                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                      bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                      2⤵
                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                      PID:1904
                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                      bcdedit.exe /set {default} recoveryenabled no
                                                                                                      2⤵
                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                      PID:1584
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                      2⤵
                                                                                                        PID:1756
                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                          3⤵
                                                                                                          • Deletes Windows Defender Definitions
                                                                                                          PID:2056
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                        2⤵
                                                                                                          PID:2068
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2088
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                          2⤵
                                                                                                            PID:2160
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                              3⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2180

                                                                                                        Network

                                                                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                                                                        Execution

                                                                                                        Command-Line Interface

                                                                                                        1
                                                                                                        T1059

                                                                                                        Persistence

                                                                                                        Modify Existing Service

                                                                                                        2
                                                                                                        T1031

                                                                                                        Defense Evasion

                                                                                                        Impair Defenses

                                                                                                        1
                                                                                                        T1562

                                                                                                        Modify Registry

                                                                                                        2
                                                                                                        T1112

                                                                                                        Disabling Security Tools

                                                                                                        1
                                                                                                        T1089

                                                                                                        Indicator Removal on Host

                                                                                                        1
                                                                                                        T1070

                                                                                                        File Deletion

                                                                                                        2
                                                                                                        T1107

                                                                                                        Credential Access

                                                                                                        Credentials in Files

                                                                                                        1
                                                                                                        T1081

                                                                                                        Collection

                                                                                                        Data from Local System

                                                                                                        1
                                                                                                        T1005

                                                                                                        Impact

                                                                                                        Inhibit System Recovery

                                                                                                        3
                                                                                                        T1490

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                          MD5

                                                                                                          aca05e59a3caefde3efd04022c34a18a

                                                                                                          SHA1

                                                                                                          eb3a09301e99af1564505fbbc40a10b6e5162a94

                                                                                                          SHA256

                                                                                                          2e1c992e321421e88b079b59b79a2860b199fb437e4cdcd6636a14d35daa8477

                                                                                                          SHA512

                                                                                                          18ceddeb4487b282d027c4baa7419e495c713183381c7e5199236cb80a28df4eb943f6794da5d576e797a42768d584a9c609bbbdc46fbd600848fbbf8bfb7046

                                                                                                        • memory/288-112-0x0000000000000000-mapping.dmp
                                                                                                        • memory/288-60-0x0000000000000000-mapping.dmp
                                                                                                        • memory/300-61-0x0000000000000000-mapping.dmp
                                                                                                        • memory/440-97-0x0000000000000000-mapping.dmp
                                                                                                        • memory/536-103-0x0000000000000000-mapping.dmp
                                                                                                        • memory/580-95-0x0000000000000000-mapping.dmp
                                                                                                        • memory/600-80-0x0000000000000000-mapping.dmp
                                                                                                        • memory/760-102-0x0000000000000000-mapping.dmp
                                                                                                        • memory/824-56-0x0000000000000000-mapping.dmp
                                                                                                        • memory/840-57-0x0000000000000000-mapping.dmp
                                                                                                        • memory/852-77-0x0000000000000000-mapping.dmp
                                                                                                        • memory/912-110-0x0000000000000000-mapping.dmp
                                                                                                        • memory/956-93-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1008-85-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1072-63-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1080-115-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1132-79-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1172-91-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1176-75-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1256-109-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1264-90-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1328-65-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1344-119-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1404-84-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1432-71-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1520-111-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1536-55-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1572-64-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1576-76-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1612-82-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1624-120-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1632-78-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1640-114-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp
                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/1640-113-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1644-66-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1644-107-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1656-67-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1664-106-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1668-69-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1684-92-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1692-108-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1696-70-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1704-68-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1712-88-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1724-104-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1736-94-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1740-101-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1748-100-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1768-72-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1808-98-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1828-81-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1840-99-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1892-105-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1896-59-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1904-121-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1928-83-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1928-62-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1952-86-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1956-87-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1968-73-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1972-96-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1976-58-0x0000000000000000-mapping.dmp
                                                                                                        • memory/1976-117-0x0000000000000000-mapping.dmp
                                                                                                        • memory/2020-74-0x0000000000000000-mapping.dmp
                                                                                                        • memory/2032-89-0x0000000000000000-mapping.dmp
                                                                                                        • memory/2088-126-0x00000000026E4000-0x00000000026E7000-memory.dmp
                                                                                                          Filesize

                                                                                                          12KB

                                                                                                        • memory/2088-125-0x00000000026E2000-0x00000000026E4000-memory.dmp
                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2088-124-0x00000000026E0000-0x00000000026E2000-memory.dmp
                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2088-127-0x00000000026EB000-0x000000000270A000-memory.dmp
                                                                                                          Filesize

                                                                                                          124KB

                                                                                                        • memory/2088-123-0x000007FEF1F10000-0x000007FEF2A6D000-memory.dmp
                                                                                                          Filesize

                                                                                                          11.4MB

                                                                                                        • memory/2180-131-0x00000000026C0000-0x00000000026C2000-memory.dmp
                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2180-132-0x00000000026C2000-0x00000000026C4000-memory.dmp
                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2180-130-0x000007FEF1F10000-0x000007FEF2A6D000-memory.dmp
                                                                                                          Filesize

                                                                                                          11.4MB

                                                                                                        • memory/2180-133-0x00000000026C4000-0x00000000026C7000-memory.dmp
                                                                                                          Filesize

                                                                                                          12KB

                                                                                                        • memory/2180-134-0x00000000026CB000-0x00000000026EA000-memory.dmp
                                                                                                          Filesize

                                                                                                          124KB