Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 03:07

General

  • Target

    fdee96f2a0bb91e93638f9f760aa8eff5a3fbcbb3f8b9ae3890f797cc58e9941.exe

  • Size

    4.9MB

  • MD5

    b3476543f689631a1f4bf0a7f40bed46

  • SHA1

    0cf21934a82945d438d2fe1f40137f77a81d0b32

  • SHA256

    fdee96f2a0bb91e93638f9f760aa8eff5a3fbcbb3f8b9ae3890f797cc58e9941

  • SHA512

    242b81ab74e567626f1f655082ffe354d1a17c93cdb155c5a1cbb7a4ea962d5547ded6a08cb4e71b9c9678a3fb8676f8ef81a190d8073f1785ed32cf0952eb21

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 9 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 35 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdee96f2a0bb91e93638f9f760aa8eff5a3fbcbb3f8b9ae3890f797cc58e9941.exe
    "C:\Users\Admin\AppData\Local\Temp\fdee96f2a0bb91e93638f9f760aa8eff5a3fbcbb3f8b9ae3890f797cc58e9941.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\start.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3824
      • C:\Program Files (x86)\System\rms.sfx.exe
        rms.sfx.exe -psdsgsadGdsgKdKJASHDJHJhjadhkJASHDK -dc:\
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\rms.exe
          "C:\rms.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4604
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:3728
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1644
              • C:\Windows\SysWOW64\attrib.exe
                attrib "C:\Program Files (x86)\System" +H +S /S /D
                7⤵
                • Drops file in Program Files directory
                • Views/modifies file attributes
                PID:1880
              • C:\Windows\SysWOW64\attrib.exe
                attrib "C:\Program Files (x86)\System\*.*" +H +S /S /D
                7⤵
                • Drops file in Program Files directory
                • Views/modifies file attributes
                PID:868
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im rutserv.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5000
              • C:\Windows\SysWOW64\taskkill.exe
                Taskkill /f /im rutserv.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3244
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im rfusclient.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4476
              • C:\Windows\SysWOW64\taskkill.exe
                Taskkill /f /im rfusclient.exe
                7⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4900
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
                7⤵
                  PID:5076
                • C:\Windows\SysWOW64\regedit.exe
                  regedit /s "regedit.reg"
                  7⤵
                  • Runs .reg file with regedit
                  PID:2248
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 2
                  7⤵
                  • Delays execution with timeout.exe
                  PID:3948
                • C:\Program Files (x86)\System\rutserv.exe
                  rutserv.exe /silentinstall
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:3552
                • C:\Program Files (x86)\System\rutserv.exe
                  rutserv.exe /firewall
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4988
                • C:\Program Files (x86)\System\rutserv.exe
                  rutserv.exe /start
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:2336
                • C:\Windows\SysWOW64\sc.exe
                  sc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/1000
                  7⤵
                    PID:4716
                  • C:\Windows\SysWOW64\sc.exe
                    sc config RManService obj= LocalSystem type= interact type= own
                    7⤵
                      PID:3712
                    • C:\Windows\SysWOW64\sc.exe
                      sc config RManService DisplayName= "Windows_Defender v6.3"
                      7⤵
                        PID:5100
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 120
                        7⤵
                        • Delays execution with timeout.exe
                        PID:4584
          • C:\Program Files (x86)\System\rutserv.exe
            "C:\Program Files (x86)\System\rutserv.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3304
            • C:\Program Files (x86)\System\rfusclient.exe
              "C:\Program Files (x86)\System\rfusclient.exe" /tray
              2⤵
              • Executes dropped EXE
              PID:2736
            • C:\Program Files (x86)\System\rfusclient.exe
              "C:\Program Files (x86)\System\rfusclient.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4600
              • C:\Program Files (x86)\System\rfusclient.exe
                "C:\Program Files (x86)\System\rfusclient.exe" /tray
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: SetClipboardViewer
                PID:2352

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\System\install.bat

            Filesize

            1KB

            MD5

            e34566750cd2942f817fc969f53852aa

            SHA1

            4b103dd2265d20f21f9edff4f04dbce6c50ead67

            SHA256

            a874138e3bae5d14dc13b3b4886bcc241b6a825de7c4af572523b5fadc1294f4

            SHA512

            8e62215233b82182bc323921bfdb203457ebfd574631467d616e630f80f59e706de3a87b7980a5b8d33c487d3a9f473f8bc0f27623c5aa659f2edd41619ba8dc

          • C:\Program Files (x86)\System\install.vbs

            Filesize

            120B

            MD5

            c719a030434d3fa96d62868f27e904a6

            SHA1

            f2f750a752dd1fda8915a47b082af7cf2d3e3655

            SHA256

            2696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f

            SHA512

            47a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0

          • C:\Program Files (x86)\System\mailsend.exe

            Filesize

            1.2MB

            MD5

            ac23b87f8ec60ddd3f555556f89a6af8

            SHA1

            3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c

            SHA256

            80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4

            SHA512

            57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167

          • C:\Program Files (x86)\System\regedit.reg

            Filesize

            12KB

            MD5

            251212852a073e6fc5fbe3af92f66adb

            SHA1

            6ee07cb20f57830325c11867e68fea49ae0e87ea

            SHA256

            f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb

            SHA512

            f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rfusclient.exe

            Filesize

            1.5MB

            MD5

            b8667a1e84567fcf7821bcefb6a444af

            SHA1

            9c1f91fe77ad357c8f81205d65c9067a270d61f0

            SHA256

            dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9

            SHA512

            ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852

          • C:\Program Files (x86)\System\rms.sfx.exe

            Filesize

            4.7MB

            MD5

            60ef589e653412de1a47d55c666acc96

            SHA1

            f75f5d11a23ebe5e1a310f5c0a71181bd4ba1c92

            SHA256

            79a7d13e12ce4716b22e8d7f4507de56c0cc4c0f35159a2af2a84147859c7220

            SHA512

            15b4563f41c7169c4128a07a2701861297bd013518202560806c4988b29bf1c16e06795385dc3fab4b05539f6fade1fdfa12b70984fd0e3dec21158c3c91764a

          • C:\Program Files (x86)\System\rms.sfx.exe

            Filesize

            4.7MB

            MD5

            60ef589e653412de1a47d55c666acc96

            SHA1

            f75f5d11a23ebe5e1a310f5c0a71181bd4ba1c92

            SHA256

            79a7d13e12ce4716b22e8d7f4507de56c0cc4c0f35159a2af2a84147859c7220

            SHA512

            15b4563f41c7169c4128a07a2701861297bd013518202560806c4988b29bf1c16e06795385dc3fab4b05539f6fade1fdfa12b70984fd0e3dec21158c3c91764a

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\rutserv.exe

            Filesize

            1.7MB

            MD5

            37a8802017a212bb7f5255abc7857969

            SHA1

            cb10c0d343c54538d12db8ed664d0a1fa35b6109

            SHA256

            1699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6

            SHA512

            4e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0

          • C:\Program Files (x86)\System\start.bat

            Filesize

            65B

            MD5

            697e66775761bcafab2582842175ee0f

            SHA1

            fa1fc9a09336bbec97aa4f8af743875cbf047b60

            SHA256

            33a896cb9380a6081647bcf1f4957b32d93af2024d3b386b502d6823b63006b3

            SHA512

            bc70bfe4e28e8a00d836f1257f1d85b5f08915bb163517fe49cab30ce9e3ad4b2302d70658636e394d7f51d145cda75c1b28934da23226c44a2bbb86b0920acf

          • C:\Program Files (x86)\System\vp8decoder.dll

            Filesize

            155KB

            MD5

            88318158527985702f61d169434a4940

            SHA1

            3cc751ba256b5727eb0713aad6f554ff1e7bca57

            SHA256

            4c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74

            SHA512

            5d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff

          • C:\Program Files (x86)\System\vp8encoder.dll

            Filesize

            593KB

            MD5

            6298c0af3d1d563834a218a9cc9f54bd

            SHA1

            0185cd591e454ed072e5a5077b25c612f6849dc9

            SHA256

            81af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172

            SHA512

            389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe

          • C:\rms.exe

            Filesize

            4.5MB

            MD5

            f89f29bd0d5239e0a979d888c9520a00

            SHA1

            7fbfff8ba4ea727eaa488a1f408a3ec53ca34177

            SHA256

            6d9ef65547cd4bbbf97c6f97aff6b54e8faf17cae2c6dcaf40b669c16a95ef6b

            SHA512

            88b64e5c80b10194f1ae1ea018cabcb2de72d880bdedfe60311c9c0965952224dcf71f930e2d3901c2b3d0398a5f23e21b125e30d0da80f056867c6eb6af6cc4

          • C:\rms.exe

            Filesize

            4.5MB

            MD5

            f89f29bd0d5239e0a979d888c9520a00

            SHA1

            7fbfff8ba4ea727eaa488a1f408a3ec53ca34177

            SHA256

            6d9ef65547cd4bbbf97c6f97aff6b54e8faf17cae2c6dcaf40b669c16a95ef6b

            SHA512

            88b64e5c80b10194f1ae1ea018cabcb2de72d880bdedfe60311c9c0965952224dcf71f930e2d3901c2b3d0398a5f23e21b125e30d0da80f056867c6eb6af6cc4

          • memory/868-143-0x0000000000000000-mapping.dmp

          • memory/1644-141-0x0000000000000000-mapping.dmp

          • memory/1880-142-0x0000000000000000-mapping.dmp

          • memory/2248-155-0x0000000000000000-mapping.dmp

          • memory/2336-178-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2336-176-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2336-173-0x0000000000000000-mapping.dmp

          • memory/2336-189-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2336-175-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2336-177-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2336-179-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/2352-211-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2352-209-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2352-208-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2352-205-0x0000000000000000-mapping.dmp

          • memory/2352-212-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2352-207-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2352-210-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-197-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-193-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-213-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-198-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-200-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-195-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/2736-187-0x0000000000000000-mapping.dmp

          • memory/3128-132-0x0000000000000000-mapping.dmp

          • memory/3244-151-0x0000000000000000-mapping.dmp

          • memory/3304-185-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3304-181-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3304-182-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3304-183-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3304-184-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3552-162-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3552-161-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3552-160-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3552-163-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3552-159-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3552-157-0x0000000000000000-mapping.dmp

          • memory/3552-164-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/3712-202-0x0000000000000000-mapping.dmp

          • memory/3728-138-0x0000000000000000-mapping.dmp

          • memory/3824-130-0x0000000000000000-mapping.dmp

          • memory/3948-156-0x0000000000000000-mapping.dmp

          • memory/4476-152-0x0000000000000000-mapping.dmp

          • memory/4584-204-0x0000000000000000-mapping.dmp

          • memory/4600-192-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4600-194-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4600-199-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4600-186-0x0000000000000000-mapping.dmp

          • memory/4600-201-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4600-196-0x0000000000400000-0x00000000009B6000-memory.dmp

            Filesize

            5.7MB

          • memory/4604-135-0x0000000000000000-mapping.dmp

          • memory/4716-191-0x0000000000000000-mapping.dmp

          • memory/4900-153-0x0000000000000000-mapping.dmp

          • memory/4988-167-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4988-165-0x0000000000000000-mapping.dmp

          • memory/4988-172-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4988-168-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4988-169-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4988-171-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/4988-170-0x0000000000400000-0x0000000000AB9000-memory.dmp

            Filesize

            6.7MB

          • memory/5000-150-0x0000000000000000-mapping.dmp

          • memory/5076-154-0x0000000000000000-mapping.dmp

          • memory/5100-203-0x0000000000000000-mapping.dmp