Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    13-07-2022 06:30

General

  • Target

    CFDI_826271_53535.exe

  • Size

    894KB

  • MD5

    f89a4c9d373e3c928bc405d56a496850

  • SHA1

    de58bf97363c74d83249df1ec2f1e9d62a2101d9

  • SHA256

    c040a2c32938707e1579fecce89e3c4fa04d019a467f642dd2bb18bab35bf99d

  • SHA512

    eb02dcd476e67db8ec0d9bfde5698967c657bbc6cb55973445c565cd10999772b8ba18ecacd85c36bb88ac81898a0d34f2509cf6e2a954c890ffc5c07421d514

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

    suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Runs net.exe
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe
        "C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1416
            • C:\Windows\SysWOW64\timeout.exe
              timeout 7
              5⤵
              • Delays execution with timeout.exe
              PID:1684
            • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
              "Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar
              5⤵
              • Executes dropped EXE
              PID:608
            • C:\Windows\SysWOW64\timeout.exe
              timeout 6
              5⤵
              • Delays execution with timeout.exe
              PID:1660
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1688
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "
                6⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1720
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"
                  7⤵
                  • Sets file to hidden
                  • Views/modifies file attributes
                  PID:652
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 1
                  7⤵
                  • Delays execution with timeout.exe
                  PID:1524
                • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
                  miktotik.exe /start
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  PID:268
                  • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
                    miktotik.exe /start
                    8⤵
                    • Executes dropped EXE
                    • Sets file execution options in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Checks processor information in registry
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    PID:572
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      9⤵
                      • Modifies firewall policy service
                      • Sets file execution options in registry
                      • Checks BIOS information in registry
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Drops desktop.ini file(s)
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies Internet Explorer Protected Mode
                      • Modifies Internet Explorer Protected Mode Banner
                      • Modifies Internet Explorer settings
                      • NTFS ADS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1600
                      • C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe
                        /suac
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:960
                      • C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe
                        "C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe"
                        10⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1728
                        • C:\Windows\system32\cmd.exe
                          "cmd.exe" /c net group "Domain Admins" /domain
                          11⤵
                            PID:1236
                            • C:\Windows\system32\net.exe
                              net group "Domain Admins" /domain
                              12⤵
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              PID:1936
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 group "Domain Admins" /domain
                                13⤵
                                  PID:832
                            • C:\Windows\system32\cmd.exe
                              "cmd.exe" /c net group "domain computers" /domain
                              11⤵
                                PID:1120
                                • C:\Windows\system32\net.exe
                                  net group "domain computers" /domain
                                  12⤵
                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                  PID:108
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 group "domain computers" /domain
                                    13⤵
                                      PID:1764
                                • C:\Windows\system32\cmd.exe
                                  "cmd.exe" /c nltest /domain_trusts /all_trusts
                                  11⤵
                                    PID:1272
                                    • C:\Windows\system32\nltest.exe
                                      nltest /domain_trusts /all_trusts
                                      12⤵
                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                      PID:1968
                                  • C:\Windows\system32\cmd.exe
                                    "cmd.exe" /c nltest /domain_trusts
                                    11⤵
                                      PID:952
                                      • C:\Windows\system32\nltest.exe
                                        nltest /domain_trusts
                                        12⤵
                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                        PID:1696
                                    • C:\Windows\system32\cmd.exe
                                      "cmd.exe" /c net view /all
                                      11⤵
                                        PID:588
                                        • C:\Windows\system32\net.exe
                                          net view /all
                                          12⤵
                                          • Discovers systems in the same network
                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                          PID:1464
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe" && /C choice /C Y /N /D Y /T 3 & Del "shfolder.dll" && Del LAG1 && Del LAG2
                                        11⤵
                                          PID:1740
                                          • C:\Windows\system32\choice.exe
                                            choice /C Y /N /D Y /T 3
                                            12⤵
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            PID:1788
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im Gozip.exe
                                  7⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:844
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im Gozip.exe
                                  7⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1284
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"
                                  7⤵
                                  • Views/modifies file attributes
                                  PID:1004
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout 4
                                  7⤵
                                  • Delays execution with timeout.exe
                                  PID:2008
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout 8
                              5⤵
                              • Delays execution with timeout.exe
                              PID:1504
                    • C:\Windows\system32\Dwm.exe
                      "C:\Windows\system32\Dwm.exe"
                      1⤵
                        PID:1180

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe

                        Filesize

                        10KB

                        MD5

                        60a1564d18f20769eb65478cc5bc56c0

                        SHA1

                        15ba12509eb288ed4e47162714f86777d8819976

                        SHA256

                        deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110

                        SHA512

                        e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

                      • C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe

                        Filesize

                        10KB

                        MD5

                        60a1564d18f20769eb65478cc5bc56c0

                        SHA1

                        15ba12509eb288ed4e47162714f86777d8819976

                        SHA256

                        deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110

                        SHA512

                        e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

                      • C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs

                        Filesize

                        114B

                        MD5

                        8f5293bc4ace65a9f51ba97bddcd7eee

                        SHA1

                        e11a5055530092c3a805d757110c4f8761976eef

                        SHA256

                        a48489f790e76faeaaed41f123031e708881226c224030213861cba419ca34f4

                        SHA512

                        c319cf12985d57b3d00737107a20e0c06a236d654064255dcc7023aa312871b52d399a9e9a55743fb3a446d2624a1049013f0ca8132ed6b6432658c396fa981d

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

                        Filesize

                        551KB

                        MD5

                        061f64173293969577916832be29b90d

                        SHA1

                        b05b80385de20463a80b6c9c39bd1d53123aab9b

                        SHA256

                        34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

                        SHA512

                        66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

                        Filesize

                        551KB

                        MD5

                        061f64173293969577916832be29b90d

                        SHA1

                        b05b80385de20463a80b6c9c39bd1d53123aab9b

                        SHA256

                        34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

                        SHA512

                        66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Preferences.dat

                        Filesize

                        373KB

                        MD5

                        b1aa11c4722efbcaaf5ebf5f17880d17

                        SHA1

                        b4b8578e13eb1a860524e827ac8bdd5d8ece604b

                        SHA256

                        2e7ba0fb3f5edd6091e13e0d3a127210813433e46cea81a61a211d6a95457e27

                        SHA512

                        a7668dfca645f63b571aff7ac11709b5578a4cd5947bf468fba11e4f5d455ef1b0917acc12c558e7b27d2eff1a8debb19b2c7783b7742c97c81b54fedcedd7b5

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat

                        Filesize

                        1KB

                        MD5

                        bf223a7df3a7feecfcb49a5d01d781d9

                        SHA1

                        d8b2b0f48887e63928576773efe1ab5776d7dfb0

                        SHA256

                        494cc4d4211c1ed3f88255a46d501040b885c9b5cca26dcae5e37185d883957e

                        SHA512

                        e15ca76450e99b21982efeeba4c148c9f28dddd85ae0fdb43e496813a4556b83022e2bb1d553de1c851065e09c7866bc6a9829da84dc0fcf3b269a03b0857fc2

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat

                        Filesize

                        668B

                        MD5

                        814380ebb377d7ebca662c6ac563eec0

                        SHA1

                        3487cf2382cd0bc87a677e637de1ae40ccfbc13b

                        SHA256

                        b58d9796ee64ea6731a6e54fdeb997ebc4ac148e3982e9c48fdc1f79d1531136

                        SHA512

                        41737175039c4f62159be44fcd683aff05be9f7ea97b7061222d34528995768cf1656c617991a5d7a5595bd958687a5adbeb208fe961aa2afb4fd2bf2a8d7d66

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs

                        Filesize

                        85B

                        MD5

                        bf045999e4ca77b57de18d5ff25e1272

                        SHA1

                        e8dab3a106e479a53c4ea61443c2ff7873d17c67

                        SHA256

                        89f2f0f40f06ed45b155adf713b127931ebb41c162e08e0cda75ecb9e10fdf17

                        SHA512

                        e191b410d97f021d3dd55ad3565559cf0f3dd6dcc7157f7d6ff60dd610128dfe875cc00f67106653df758e07b6d845fc4e7a7ee290f8d7d8a58d58a90a018f6a

                      • \Users\Admin\AppData\Local\Temp\s191iag1y.exe

                        Filesize

                        10KB

                        MD5

                        60a1564d18f20769eb65478cc5bc56c0

                        SHA1

                        15ba12509eb288ed4e47162714f86777d8819976

                        SHA256

                        deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110

                        SHA512

                        e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

                      • \Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • \Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

                        Filesize

                        551KB

                        MD5

                        061f64173293969577916832be29b90d

                        SHA1

                        b05b80385de20463a80b6c9c39bd1d53123aab9b

                        SHA256

                        34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

                        SHA512

                        66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

                      • \Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • \Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • \Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

                        Filesize

                        947KB

                        MD5

                        6ed0cca96fe69be3b775499509f0b029

                        SHA1

                        e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

                        SHA256

                        bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

                        SHA512

                        a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

                      • memory/108-142-0x0000000000000000-mapping.dmp

                      • memory/268-96-0x0000000000400000-0x000000000049B000-memory.dmp

                        Filesize

                        620KB

                      • memory/268-86-0x0000000000000000-mapping.dmp

                      • memory/572-108-0x0000000001EF0000-0x0000000001F56000-memory.dmp

                        Filesize

                        408KB

                      • memory/572-97-0x0000000000400000-0x0000000000435000-memory.dmp

                        Filesize

                        212KB

                      • memory/572-90-0x0000000000400000-0x0000000000435000-memory.dmp

                        Filesize

                        212KB

                      • memory/572-92-0x0000000000400000-0x0000000000435000-memory.dmp

                        Filesize

                        212KB

                      • memory/572-93-0x00000000004015C6-mapping.dmp

                      • memory/572-109-0x0000000000260000-0x000000000026D000-memory.dmp

                        Filesize

                        52KB

                      • memory/572-107-0x0000000000400000-0x0000000000435000-memory.dmp

                        Filesize

                        212KB

                      • memory/572-110-0x00000000003F0000-0x00000000003FC000-memory.dmp

                        Filesize

                        48KB

                      • memory/572-123-0x0000000001EF0000-0x0000000001F56000-memory.dmp

                        Filesize

                        408KB

                      • memory/572-101-0x0000000000400000-0x0000000000435000-memory.dmp

                        Filesize

                        212KB

                      • memory/572-103-0x0000000001EF0000-0x0000000001F56000-memory.dmp

                        Filesize

                        408KB

                      • memory/588-148-0x0000000000000000-mapping.dmp

                      • memory/608-66-0x0000000000000000-mapping.dmp

                      • memory/652-79-0x0000000000000000-mapping.dmp

                      • memory/832-140-0x0000000000000000-mapping.dmp

                      • memory/844-100-0x0000000000000000-mapping.dmp

                      • memory/952-146-0x0000000000000000-mapping.dmp

                      • memory/960-131-0x0000000000400000-0x000000000049B000-memory.dmp

                        Filesize

                        620KB

                      • memory/960-128-0x0000000000000000-mapping.dmp

                      • memory/992-55-0x0000000000000000-mapping.dmp

                      • memory/1004-113-0x0000000000000000-mapping.dmp

                      • memory/1120-141-0x0000000000000000-mapping.dmp

                      • memory/1212-126-0x0000000002650000-0x0000000002656000-memory.dmp

                        Filesize

                        24KB

                      • memory/1236-138-0x0000000000000000-mapping.dmp

                      • memory/1272-144-0x0000000000000000-mapping.dmp

                      • memory/1280-54-0x0000000076181000-0x0000000076183000-memory.dmp

                        Filesize

                        8KB

                      • memory/1284-111-0x0000000000000000-mapping.dmp

                      • memory/1416-59-0x0000000000000000-mapping.dmp

                      • memory/1464-149-0x0000000000000000-mapping.dmp

                      • memory/1504-73-0x0000000000000000-mapping.dmp

                      • memory/1524-81-0x0000000000000000-mapping.dmp

                      • memory/1600-124-0x0000000077BE0000-0x0000000077D60000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1600-121-0x00000000002A0000-0x00000000003F6000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/1600-117-0x0000000000000000-mapping.dmp

                      • memory/1600-132-0x0000000003A50000-0x0000000003AEB000-memory.dmp

                        Filesize

                        620KB

                      • memory/1600-125-0x00000000002A0000-0x00000000003F6000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/1600-119-0x0000000074A41000-0x0000000074A43000-memory.dmp

                        Filesize

                        8KB

                      • memory/1600-120-0x0000000077BE0000-0x0000000077D60000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1600-122-0x0000000000250000-0x000000000025C000-memory.dmp

                        Filesize

                        48KB

                      • memory/1660-69-0x0000000000000000-mapping.dmp

                      • memory/1684-61-0x0000000000000000-mapping.dmp

                      • memory/1688-72-0x0000000000000000-mapping.dmp

                      • memory/1696-147-0x0000000000000000-mapping.dmp

                      • memory/1720-77-0x0000000000000000-mapping.dmp

                      • memory/1720-106-0x0000000000230000-0x00000000002CB000-memory.dmp

                        Filesize

                        620KB

                      • memory/1720-105-0x0000000000230000-0x00000000002CB000-memory.dmp

                        Filesize

                        620KB

                      • memory/1728-134-0x0000000000000000-mapping.dmp

                      • memory/1728-137-0x0000000000130000-0x0000000000138000-memory.dmp

                        Filesize

                        32KB

                      • memory/1728-150-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

                        Filesize

                        8KB

                      • memory/1740-151-0x0000000000000000-mapping.dmp

                      • memory/1764-143-0x0000000000000000-mapping.dmp

                      • memory/1788-152-0x0000000000000000-mapping.dmp

                      • memory/1936-139-0x0000000000000000-mapping.dmp

                      • memory/1968-145-0x0000000000000000-mapping.dmp

                      • memory/2008-115-0x0000000000000000-mapping.dmp