Analysis
- user interaction
yes - max time kernel
12s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 19:58
Errors
Reason
Machine shutdown
General
- Target SvinoLock.exe
- Size 5.7MB
- Sample260809-yp8y6avdpg
- SHA256 689946c4b66ea7e4fdd310a915463a1a9493bcd87f239b8c310199efe4a56ddd
Score
9/10
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 10 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 42 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 42 IoCs
- Suspicious use of SendNotifyMessage 25 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"C:\Users\Admin\AppData\Local\Temp\SvinoLock.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safeboot minimal3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safeboot disabled3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootmenupolicy legacy3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} advancedoptions false3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} optionsedit false3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reagentc /disable2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} recoverysequence3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} recoveryenabled3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} recoverysequence3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f2⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /tr "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /f2⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_OneDriveSetup" /f2⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_OneDriveSetup" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\OneDriveSetup.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_SystemRestoreHelper" /f2⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_SystemRestoreHelper" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\SystemRestoreHelper.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /f2⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f2⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe"2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot minimal3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} safeboot disabled3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} safeboot disabled3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootmenupolicy legacy3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} advancedoptions false3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} optionsedit false3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reagentc /disable3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoverysequence3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {default} recoveryenabled3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoverysequence3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} recoveryenabled3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled No3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /f3⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_WindowsDefenderUpdate" /tr "C:\ProgramData\Microsoft\Windows\Caches\WindowsDefenderUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /f3⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_OneDriveSetup" /f3⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_OneDriveSetup" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\OneDriveSetup.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_SystemRestoreHelper" /f3⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_SystemRestoreHelper" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\SystemRestoreHelper.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" schtasks /delete /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /f3⤵
- Indicator Removal: Clear Persistence
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /tn "MicrosoftUpdateTask_MicrosoftUpdateService" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\MicrosoftUpdateService.exe" /sc onlogon /ru "Admin" /rl HIGHEST /f3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Account Web Data-journal.encrypted
CURRENT.encrypted
MANIFEST-000001.encrypted
data_0.encrypted
data_1.encrypted
data_2.encrypted
data_3.encrypted
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
MicrosoftUpdateService.exe
1451318868ntouromlalnodry--epcr.sqlite-shm.encrypted
3561288849sdhlie.sqlite.encrypted
memory/2460-239-0x000001EC801E0000-0x000001EC802E0000-memory.dmp
memory/2460-271-0x000001EC83B70000-0x000001EC83B90000-memory.dmp
memory/2460-255-0x000001EC93D90000-0x000001EC93E90000-memory.dmp
memory/2460-285-0x000001EC83970000-0x000001EC83990000-memory.dmp
memory/2460-253-0x000001EC83910000-0x000001EC83930000-memory.dmp
memory/3488-11-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-8-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-205-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-206-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-207-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-208-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-209-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-210-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-211-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-212-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-213-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-1-0x000002B633020000-0x000002B6335DC000-memory.dmp
memory/3488-215-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-2-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-3-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-4-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-5-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-6-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-12-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-0-0x00007FFC6282F000-0x00007FFC62830000-memory.dmp
memory/3488-9-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-10-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/3488-7-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp
memory/4680-48-0x0000021083A40000-0x0000021083A60000-memory.dmp
memory/4680-60-0x0000021083D60000-0x0000021083D80000-memory.dmp
memory/4680-49-0x0000021093E80000-0x0000021093F80000-memory.dmp
memory/4680-36-0x00000210801E0000-0x00000210802E0000-memory.dmp
memory/4680-37-0x00000210801E0000-0x00000210802E0000-memory.dmp
memory/4680-35-0x00000210801E0000-0x00000210802E0000-memory.dmp
memory/4680-81-0x0000021094280000-0x00000210942A0000-memory.dmp