Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-03-2024 00:38

General

  • Target

    Version 2.8.exe

  • Size

    227KB

  • MD5

    2ab8e3e63a7c847855ad80770dc2fd59

  • SHA1

    dae76d78053f9699f4cb7ccae51df9d4b6202ac7

  • SHA256

    7d306cc818d68effe14ccbebc60f2bb6de75a9e6fb2c840e5ffe575ebf98376b

  • SHA512

    6a968d8c7e96c121b77a8bdc14e709fa79301d6f660d933e487008c09f6bdbf356ac4bfa31bab62f8dd69cfbc2e8c43a17ff86133a8d0c1cd4db343cf8366b31

  • SSDEEP

    6144:yR9ixUkjCMkI3pwo9EkhtNK3OotdWV3vBLGC:oof+ewfkhsnWBvBj

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Ransom Note
All of your files have been encrypted! Warning Attempting to remove the software will corrupt your hard drives meaning no further use even when wiped. We simply charge $25 which is far cheaper than buying a new drive. Your computer was infected with a ransomware software. Your files have been encrypted and you won't be able to decrypt them without purchasing $25 BTC. What can I do to get my files back? You will send payment of $25 BTC to gain access to your files again, once payment is made after 3 confirmations on the blockchain (15 mins) your files will be restored and the software will un-install itself from your computer. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment will increase soon to double, be cooperative and your files will be released. Payment information Amount: 0.000385636 BTC Bitcoin Address: bc1qc76qr24pxnms9f93mytfg4dn7ztuvmje7g43dr

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

  • Chaos Ransomware 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 34 IoCs
  • Drops file in System32 directory 11 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 58 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Version 2.8.exe
    "C:\Users\Admin\AppData\Local\Temp\Version 2.8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:2868
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:316
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1512
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4344
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3204
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4304
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:3600
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4432
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2788
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:4812
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4228
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\read_it.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:668
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2968
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:624
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\SuspendStop.xla"
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4296
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\SuspendStop.xla"
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:272
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Documents\WatchUnpublish.dotm"
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4312
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\CompressDisable.xlsm"
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:2972
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\CompareRequest.ods"
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3788
      • C:\Windows\system32\mspaint.exe
        "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\CheckpointCompress.bmp"
        1⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3024
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
        1⤵
          PID:4940
        • C:\Windows\system32\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\ExpandResize.jpeg" /ForceBootstrapPaint3D
          1⤵
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2296
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
          1⤵
          • Drops file in System32 directory
          PID:2836
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3576
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\DismountHide.mpeg"
          1⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2276

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

          Filesize

          471B

          MD5

          59a10c466b70e95b0895f621b8cc5489

          SHA1

          5a545958147ab9c7adc42e64d02c3e70b7e2e089

          SHA256

          c47133941d2c12d0ce1f5b832a5f688ee284b9eaf1000c8fb84ccc1993a50f80

          SHA512

          4ec215c21760c7c286321633ddb0a94da1a476a076a6a3a25e45b5bc1c496cc191590791f70b8cb05a1c36e131186e694071f176cc328a7b94f28e1544c2f231

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

          Filesize

          412B

          MD5

          8fae59fe9dc647315277fd4ed47cb211

          SHA1

          f619d4dfaf39d45c374ace2847c69721ede5f2f4

          SHA256

          8c8490f628716677bb0c0de91e0f7bd27bbae274c8e180c3976eee59b1c82347

          SHA512

          d18d164b27e49501e6e14b18f480bd2a9a69645e0be3b598bb4ce6d858748d05982d5192ba6f9daf76dd318b1893eaa63a5307a26557c3a67fa8a205c1944dc5

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.CampaignStates.json

          Filesize

          21B

          MD5

          f1b59332b953b3c99b3c95a44249c0d2

          SHA1

          1b16a2ca32bf8481e18ff8b7365229b598908991

          SHA256

          138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

          SHA512

          3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.GovernedChannelStates.json

          Filesize

          417B

          MD5

          c56ff60fbd601e84edd5a0ff1010d584

          SHA1

          342abb130dabeacde1d8ced806d67a3aef00a749

          SHA256

          200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

          SHA512

          acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.Settings.json

          Filesize

          87B

          MD5

          e4e83f8123e9740b8aa3c3dfa77c1c04

          SHA1

          5281eae96efde7b0e16a1d977f005f0d3bd7aad0

          SHA256

          6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

          SHA512

          bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Excel.SurveyHistoryStats.json

          Filesize

          14B

          MD5

          6ca4960355e4951c72aa5f6364e459d5

          SHA1

          2fd90b4ec32804dff7a41b6e63c8b0a40b592113

          SHA256

          88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

          SHA512

          8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B37701-F0D5-40FC-8A1E-16C4E7895769

          Filesize

          160KB

          MD5

          8ad766173a1d98da6a933aff76768df9

          SHA1

          114d383c83f28232a8ed5ed95dc0e8716c1d4e0c

          SHA256

          1ec2863366481a127f1e7e2e124304f2af89ee8c0a98971c134293d9a84f36f9

          SHA512

          3978d07a79a7468beb39535465ff617124c0fdd4a63456d3e446bb0a0114551140915033c4eb203ab31e50eb527ec633cebac80f6f020f3f0b6303fc1073bf75

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

          Filesize

          321KB

          MD5

          9a31984beee041a8946d5a6c8b0ceca5

          SHA1

          d8df49013f8e2e98078f887a51afa7a635a6ab3a

          SHA256

          9a47070c102054a55102bf3ef85f911c4d6b750bb187a3cef148f589418d4a7d

          SHA512

          75efabc90e355221d9690bdb6a3e583640ea4eee5fd265a4e3b72847d7a0ffa4ca05dcbd7dc08bf4913862920b9864d06fc89fde220dad7e7a7d427f29bec9b2

        • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

          Filesize

          24KB

          MD5

          8665de22b67e46648a5a147c1ed296ca

          SHA1

          b289a96fee9fa77dd8e045ae8fd161debd376f48

          SHA256

          b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

          SHA512

          bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

        • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

          Filesize

          24KB

          MD5

          085ebd119f5fc6b8f63720fac1166ff5

          SHA1

          af066018aadec31b8e70a124a158736aca897306

          SHA256

          b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687

          SHA512

          adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875

        • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db

          Filesize

          80KB

          MD5

          294b3286e4f3bbbc408bd54b0691e935

          SHA1

          adaf3fac4462f540ea29820980b2607495e1e4c9

          SHA256

          fef9230227ec3b344775b3fa79221ded071afcf2d9d182c269f6cc66af23168f

          SHA512

          efa2b8a96a6488a344531be6c074817933237c03524627cf18e0d24b6d5c0b565b60da3b065d9baa5a24d86ec7f144151b80558591742be57d1c03984fdbcc56

        • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

          Filesize

          2KB

          MD5

          9be38927c27ea8a63ef4e2b25010176e

          SHA1

          54c3311e00312cdcf9e0b182703d4078b81d3ddd

          SHA256

          456455d7c4d421727649a35e2a9016b52e106d804f13ebf91154b76f2194c0e1

          SHA512

          b3fc866ae01a4561392745b8a28c83a20006b1166f5dd369b6e6f0c359dfd6bc0c4c2928aa5071c64e8d0f4b3b28c81583ebc920570adc1b21f29a24a852f0ea

        • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

          Filesize

          2KB

          MD5

          eef7868555d726485f11ee7287a14b63

          SHA1

          b4adc673ef4c84b3758e58919b1fe9d3c3160bd3

          SHA256

          02cba83a44056f45248b990f9ebb39c98ca4949d339f20120857ef1c2ddcd79a

          SHA512

          6e4fd2b23b7349d70eb60b480ce6b23572a37c165e00e53f335c6bee1aa58abf789f4cf9a8d0651ef29892038dba00e8e18d1d44b0173308f91091f49a36356a

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          259B

          MD5

          f1b680fb961e172c0af6716e6e06cb3c

          SHA1

          65e1b755ae2b027fad865c792d8c31a5d7da5d4e

          SHA256

          3f8408705ebb104da8d8f1aeb44c01dcb64eef62a7771df7ebf473631564b76c

          SHA512

          add15b1dd3e9581adf80770c0ae0e3cad5363d1b0ed13a6e8d3a108859a69d36f3d4f2b4d8c452235b34f6d7fae13c42f403fad234133c5c56507acab03aaf0a

        • C:\Users\Admin\AppData\Roaming\svchost.exe

          Filesize

          227KB

          MD5

          2ab8e3e63a7c847855ad80770dc2fd59

          SHA1

          dae76d78053f9699f4cb7ccae51df9d4b6202ac7

          SHA256

          7d306cc818d68effe14ccbebc60f2bb6de75a9e6fb2c840e5ffe575ebf98376b

          SHA512

          6a968d8c7e96c121b77a8bdc14e709fa79301d6f660d933e487008c09f6bdbf356ac4bfa31bab62f8dd69cfbc2e8c43a17ff86133a8d0c1cd4db343cf8366b31

        • C:\Users\Admin\Desktop\read_it.txt

          Filesize

          1KB

          MD5

          ea03cbb2fdf2dc96252b579612602225

          SHA1

          ac9ceff3c368f7409b9a7201f62fa92eded4da51

          SHA256

          e4f0c335d1ffc3ed4a32ae4aee294c9652f67a765fbaaad1f90e0540d25ed565

          SHA512

          1388a3f740f84541f8a8c0298bfe8b71f03d86a71174f97a68edcb4bdca0f467d6823b94314fa54547451c3ec4f6bc2228d74bf7537acf7c2dfb9f5a2d398051

        • memory/272-137-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-130-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-123-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-127-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-129-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-125-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-136-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-135-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-133-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-132-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/272-174-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/404-16-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

          Filesize

          10.8MB

        • memory/404-72-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

          Filesize

          10.8MB

        • memory/2836-305-0x0000027EA1180000-0x0000027EA1190000-memory.dmp

          Filesize

          64KB

        • memory/2972-231-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-239-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-229-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-233-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-232-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-234-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-236-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-237-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-238-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-228-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-241-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-242-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-243-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-266-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/2972-244-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-277-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-270-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-271-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-273-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-275-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-276-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-278-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-280-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3788-303-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/3804-15-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

          Filesize

          10.8MB

        • memory/3804-1-0x0000000000C50000-0x0000000000CA0000-memory.dmp

          Filesize

          320KB

        • memory/3804-0-0x0000000000470000-0x00000000004B0000-memory.dmp

          Filesize

          256KB

        • memory/3804-2-0x00007FFB4A060000-0x00007FFB4AB21000-memory.dmp

          Filesize

          10.8MB

        • memory/4296-83-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-91-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-120-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-119-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-118-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-117-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-94-0x00007FFB260F0000-0x00007FFB26100000-memory.dmp

          Filesize

          64KB

        • memory/4296-93-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-92-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-90-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-89-0x00007FFB260F0000-0x00007FFB26100000-memory.dmp

          Filesize

          64KB

        • memory/4296-88-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-87-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-79-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-80-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-82-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-81-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-84-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-121-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4296-85-0x00007FFB281B0000-0x00007FFB281C0000-memory.dmp

          Filesize

          64KB

        • memory/4296-86-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-188-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-190-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-192-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-194-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-198-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-196-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-197-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-199-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-223-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB

        • memory/4312-202-0x00007FFB260F0000-0x00007FFB26100000-memory.dmp

          Filesize

          64KB

        • memory/4312-201-0x00007FFB260F0000-0x00007FFB26100000-memory.dmp

          Filesize

          64KB

        • memory/4312-200-0x00007FFB68130000-0x00007FFB68325000-memory.dmp

          Filesize

          2.0MB