Overview

overview

10

Static

static

266f930572...95.jse

windows7-x64

10

266f930572...95.jse

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2022 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    266f930572d3006c36ba7e97b4ffed107827decd7738a58c218e1ae5450fbe95.jse

  • Size

    176KB

  • MD5

    ad184cf93d38d51111a7ef305992eb5f

  • SHA1

    37b05248dbd96c8a94082471069f24a7b1036313

  • SHA256

    266f930572d3006c36ba7e97b4ffed107827decd7738a58c218e1ae5450fbe95

  • SHA512

    a37d0984d65b0eaef4169a22e5802ac8f24b9508b717f46b2911ad583f5a4b2e4f59bd31c317976f14995ba69a7855318ef7d5e0ba866d3b8fc1db352a14c56e

  • SSDEEP

    3072:x4xkakIeI6QKzm+bga+V9cw+yOTE4o5V0eD11TbXx1113B1WR9KflL11H6IFNC4v:GfelQKzbMYJQ4o5VxhakLDNyjt8

Score
10/10
magniberevasionpersistenceransomware

Malware Config

Signatures

  • Detect magniber ransomware 3 IoCs
  • Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Modifies extensions of user files
    • Modifies registry class
    PID:2256
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
    • Modifies registry class
    PID:2268
  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
    • Modifies registry class
    PID:2376
    • C:\Windows\System32\cmd.exe
      /c fodhelper.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\System32\fodhelper.exe
        fodhelper.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Windows\system32\wscript.exe
          "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/ehfufygcrb.now
          4⤵
            PID:3904
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
      • C:\Windows\System32\WScript.exe
        C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\266f930572d3006c36ba7e97b4ffed107827decd7738a58c218e1ae5450fbe95.jse"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3880
      • C:\Windows\System32\cmd.exe
        /c fodhelper.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\System32\fodhelper.exe
          fodhelper.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3140
          • C:\Windows\system32\wscript.exe
            "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/uvycobolpoj.now
            4⤵
              PID:3892
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3004 -s 3328
          2⤵
          • Program crash
          PID:3024
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3004 -s 5376
          2⤵
          • Program crash
          PID:1144
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:3208
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3208 -s 148
            2⤵
            • Program crash
            PID:4564
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
          1⤵
          • Modifies registry class
          PID:684
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3300
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:3360
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3456
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
              • Modifies registry class
              PID:1096
              • C:\Windows\System32\cmd.exe
                /c fodhelper.exe
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3332
                • C:\Windows\System32\fodhelper.exe
                  fodhelper.exe
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2084
                  • C:\Windows\system32\wscript.exe
                    "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/uvycobolpoj.now
                    4⤵
                      PID:4968
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4620
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                1⤵
                  PID:2392
                • C:\Windows\System32\RuntimeBroker.exe
                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                  1⤵
                  • Modifies registry class
                  PID:4960
                  • C:\Windows\System32\cmd.exe
                    /c fodhelper.exe
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4300
                    • C:\Windows\System32\fodhelper.exe
                      fodhelper.exe
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4772
                      • C:\Windows\system32\wscript.exe
                        "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/dmiooruqdq.now
                        4⤵
                          PID:4676
                  • C:\Windows\System32\RuntimeBroker.exe
                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                    1⤵
                    • Modifies registry class
                    PID:3692
                    • C:\Windows\System32\cmd.exe
                      /c fodhelper.exe
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2188
                      • C:\Windows\System32\fodhelper.exe
                        fodhelper.exe
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1772
                        • C:\Windows\system32\wscript.exe
                          "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/ehfufygcrb.now
                          4⤵
                            PID:3648
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 448 -p 3208 -ip 3208
                      1⤵
                        PID:1988
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3260
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /set {default} bootstatuspolicy ignoreallfailures
                        1⤵
                        • Process spawned unexpected child process
                        • Modifies boot configuration data using bcdedit
                        PID:3992
                      • C:\Windows\system32\bcdedit.exe
                        bcdedit /set {default} recoveryenabled no
                        1⤵
                        • Process spawned unexpected child process
                        • Modifies boot configuration data using bcdedit
                        PID:3568
                      • C:\Windows\system32\wbadmin.exe
                        wbadmin delete systemstatebackup -quiet
                        1⤵
                        • Process spawned unexpected child process
                        • Deletes System State backups
                        PID:3248
                      • C:\Windows\system32\wbadmin.exe
                        wbadmin delete catalog -quiet
                        1⤵
                        • Process spawned unexpected child process
                        • Deletes backup catalog
                        PID:3232
                      • C:\Windows\system32\wbengine.exe
                        "C:\Windows\system32\wbengine.exe"
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3752
                      • C:\Windows\System32\vdsldr.exe
                        C:\Windows\System32\vdsldr.exe -Embedding
                        1⤵
                          PID:3708
                        • C:\Windows\System32\vds.exe
                          C:\Windows\System32\vds.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:3868
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 540 -p 3004 -ip 3004
                          1⤵
                            PID:1380
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -pss -s 460 -p 3004 -ip 3004
                            1⤵
                              PID:4076
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:2572
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:3880
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Enumerates system info in registry
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4176

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\USERS\ADMIN\DESKTOP\CHECKPOINTTEST.PNG.LFQXDCB
                              Filesize

                              269KB

                              MD5

                              8466a3ed3a9f8b186e6a1d41b62f567a

                              SHA1

                              044b76a18868630819c143293370be64cf47bed2

                              SHA256

                              26d2aeaec96b888f31ef8392b19e433f688c2da190defd06093bcadde66c2596

                              SHA512

                              5687994927d2d16086851de3940c23f7ce0b205a385b5420d44d510133dfe206ff203f8ce18dc6052a47b34ce91c03be627f02e37eb7f74c361d32f9beacec07

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\COMPLETESPLIT.CRW.LFQXDCB
                              Filesize

                              492KB

                              MD5

                              8c04dafe9888690397ff720d4816c5d7

                              SHA1

                              c44ed6465acec1e941cd2429f77335e28a9b157b

                              SHA256

                              9cdde516f456e19cbfef8e36c4f8e62fc4a29ed8162386c7d55a14d77a8601f1

                              SHA512

                              510bed26d104cb03254c420d51cd8907c11e60394c2c965106565f9f85bb5b8af8204354d0c92d2a118b5c653c7559e48a17e333a04796dfc3158f22a6a5e02b

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\ENTERWRITE.MPEG.LFQXDCB
                              Filesize

                              455KB

                              MD5

                              88fa06fe28a4a1b4acbd9541d63b4014

                              SHA1

                              a19687fa8e567a2ff23be9e41b626e42f2454501

                              SHA256

                              f8fb7757c370ba1d2300075f1da9da2798fc9a916aab32a8b7690b56c8858a4e

                              SHA512

                              80d2f1d6c7bffea283ece600709049cad01e9270d14b831b9e3a42efcba2dddf6cd307aa79e75383413b78db0d38f5db754a13d87f8b889727ce6bf8f99ffa9d

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\LOCKGRANT.RTF.LFQXDCB
                              Filesize

                              306KB

                              MD5

                              a2ac37e8313b89099610af3e658738e3

                              SHA1

                              aeab4be771efaedff6755ab851987fbb16a866dc

                              SHA256

                              b6ff707f8bf6bcb3753640f759368ffe3191d73d2b5cbb4913f5277c039e1690

                              SHA512

                              245181555473d099fc7cfe71081a6074efd8414c163255aacd6d06959f1d6d83dbe236dd6ff7bfa75853588edf578cf82dab06f09a21176e06a40ecf682727a7

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\README.HTML
                              Filesize

                              18KB

                              MD5

                              4f093dd84f1e7a6180fd6cb3c22af2dc

                              SHA1

                              1353566bf1067f5193290b76b4c92bcd0a24d007

                              SHA256

                              fa55bbb874b9ca82f02742893b1877673ed57b5e22aae2d020d12e85296f00b9

                              SHA512

                              191b22ba7f5fe651c6d75d4be4a154ce1064b915675a3bc153f5948535a061e224c289a18aaa3b6e3c495388fb8e8ea26aad138d451559f63be3a347da3551fb

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\REPAIRWATCH.XLTM.LFQXDCB
                              Filesize

                              548KB

                              MD5

                              ae8f6360847cd6cd9284d41c1c691394

                              SHA1

                              613a6f23f7836e8807a1a4ddd599f4084168e5a4

                              SHA256

                              ef628006664c4b9d53b8a95498590beffc1cc9614adc6faa32c21ecb02fbd903

                              SHA512

                              8db92d67268c3921abb366bc6049c532c70a5e0eb41576dbb0329633e4ffcfac3b6d66692faba6a2b163656328583b53d88dd348c3181e5520372190ce78ca65

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\SUSPENDDISCONNECT.POTX.LFQXDCB
                              Filesize

                              362KB

                              MD5

                              dc5652e788d003b24f7e8d86f6cbfe4c

                              SHA1

                              7ef855a56b94f7d4c30da22aa23aa0050a5aee41

                              SHA256

                              58ac5bb998f3988192c2aa30c594bd8c2bd8515287e3dda079db7d7b16ef26f4

                              SHA512

                              37ec3588a4c6fd6ad64ba1341079c98160064181149cfdec7f75d2bd1ba36fd40bcba711d2a4d84a4dcaa0c4763e28345d9215c58423086aeb91986c7c6202e2

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\UNDOHIDE.VSTX.LFQXDCB
                              Filesize

                              195KB

                              MD5

                              5857593f67d28ea751fdbb03eafbfe6b

                              SHA1

                              e65fa6388a67d0d4e75467f97469f4f3f149c9a3

                              SHA256

                              e72bc48d96f7f9472540223b56934a26c5b562abb57adc5f82f167f5accbfc1e

                              SHA512

                              26de8b0ed9c3bffac11cffcf66104220302513ac156fcb6e5f9fac75bb8093254811ddbed589bd2ea2a00c8c43aedb2f21fa1ec9e0c6f6da3eaaa673896109dc

                              Download Submit

                            • C:\USERS\ADMIN\DESKTOP\UNDOUPDATE.DOCX.LFQXDCB
                              Filesize

                              381KB

                              MD5

                              8acf1f12e294ad3497acef33a8060f6c

                              SHA1

                              7d268b29236c8b5260b32197fc9e970631413d1f

                              SHA256

                              257f2a45ecd53a6e1dd234b0af817d60d91228223909dc203402627c7bcedebb

                              SHA512

                              0028f74d29be8571cdb9d30c7c1fd8b6f33d19f3e2a5eef3fb6be0f6ed01ad9355116dba6862fd6023f6b1e91f487924c589f32515cf5484a89e902b3087226d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\142342d41ce347c0906ec0b34678cc85_1
                              Filesize

                              3KB

                              MD5

                              e23ba7e98051cbeaec2791cded337431

                              SHA1

                              188c3de3114e1eed2bfd329e4f38124b1af1a02f

                              SHA256

                              4c73a8058640191c5521ce64d1ecfb40baa8f00ce5749bb6dc3956798d5caac5

                              SHA512

                              80a919179278fdf3766815b6ecdf18978cb5df7a242e1e555430ff5461acf92579ac477c8fa33bdcf395643c6a78decf58c5064e43ff6afd580dfd5a4578c1e7

                              Download Submit

                            • C:\Users\Public\uvycobolpoj.now
                              Filesize

                              880B

                              MD5

                              b190ff090537a6cd507870077a4a6160

                              SHA1

                              7d23d91564a6dcb298b03b122d0f4e329a4f29f4

                              SHA256

                              422626de7cbc0fb2c7c36fd85ae325b873270d027666fe47d9588cd81489c053

                              SHA512

                              a151b50cb3bc593b605c01e38d3c438dba472e3635f2ebf3646d1febe8deb2c74c997457cd3af51a7f528311f4c28f752b5ed7bac1b087b389d1368ebcf9978b

                              Download Submit

                            • memory/1772-220-0x0000000000000000-mapping.dmp

                              Download

                            • memory/2084-176-0x0000000000000000-mapping.dmp

                              Download

                            • memory/2256-135-0x00000250DB140000-0x00000250DB14B000-memory.dmp

                              Filesize

                              44KB

                              Download

                            • memory/3004-168-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-175-0x0000000007C20000-0x0000000007C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-162-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-163-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-164-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-165-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-166-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-167-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-160-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-169-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-170-0x0000000007C20000-0x0000000007C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-171-0x0000000007C20000-0x0000000007C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-172-0x0000000007C20000-0x0000000007C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-173-0x0000000007C20000-0x0000000007C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-174-0x0000000007C20000-0x0000000007C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-161-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-159-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-153-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-154-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-155-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-158-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-157-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3004-156-0x0000000007C00000-0x0000000007C10000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3140-178-0x0000000000000000-mapping.dmp

                              Download

                            • memory/3648-221-0x0000000000000000-mapping.dmp

                              Download

                            • memory/3828-222-0x0000000000000000-mapping.dmp

                              Download

                            • memory/3880-132-0x00007FFE93F90000-0x00007FFE94A51000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/3880-151-0x00007FFE93F90000-0x00007FFE94A51000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/3880-147-0x000001D4CA060000-0x000001D4CB060000-memory.dmp

                              Filesize

                              16.0MB

                              Download

                            • memory/3880-146-0x00007FFE93F90000-0x00007FFE94A51000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/3880-134-0x000001D4CA060000-0x000001D4CB060000-memory.dmp

                              Filesize

                              16.0MB

                              Download

                            • memory/3892-179-0x0000000000000000-mapping.dmp

                              Download

                            • memory/3904-223-0x0000000000000000-mapping.dmp

                              Download

                            • memory/4176-213-0x0000020B94D54000-0x0000020B94D58000-memory.dmp

                              Filesize

                              16KB

                              Download

                            • memory/4176-207-0x0000020B92E20000-0x0000020B92E28000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/4176-211-0x0000020B94D54000-0x0000020B94D58000-memory.dmp

                              Filesize

                              16KB

                              Download

                            • memory/4176-210-0x0000020B94D54000-0x0000020B94D58000-memory.dmp

                              Filesize

                              16KB

                              Download

                            • memory/4176-218-0x0000020B94D58000-0x0000020B94D5B000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4176-217-0x0000020B94D58000-0x0000020B94D5B000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4176-216-0x0000020B94D58000-0x0000020B94D5B000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4176-203-0x0000020B94D5B000-0x0000020B94D5E000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4176-212-0x0000020B94D54000-0x0000020B94D58000-memory.dmp

                              Filesize

                              16KB

                              Download

                            • memory/4176-205-0x0000020B94D5B000-0x0000020B94D5E000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4176-208-0x0000020BA5C30000-0x0000020BA5D30000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/4176-209-0x0000020B94D54000-0x0000020B94D58000-memory.dmp

                              Filesize

                              16KB

                              Download

                            • memory/4176-202-0x0000020B94D5B000-0x0000020B94D5E000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4176-197-0x0000020B93B60000-0x0000020B93B80000-memory.dmp

                              Filesize

                              128KB

                              Download

                            • memory/4176-204-0x0000020B94D5B000-0x0000020B94D5E000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4676-225-0x0000000000000000-mapping.dmp

                              Download

                            • memory/4772-224-0x0000000000000000-mapping.dmp

                              Download

                            • memory/4968-177-0x0000000000000000-mapping.dmp

                              Download