Analysis
-
max time kernel
127s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-10-2021 09:43
Static task
static1
Behavioral task
behavioral1
Sample
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe
Resource
win10-en-20211014
General
-
Target
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe
-
Size
6.7MB
-
MD5
2e3b62f4f1669b3615608ea31e1796dd
-
SHA1
9f9584588e480c0cfc18b770da47b00919e24219
-
SHA256
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625
-
SHA512
2879f87ce2e3c075512408fbdb17a01209663c2f635c3e07cec1d8e9b1f0490c9219eea2229dcd5863467435d35bef874e9d5fd243e46b02850d0157288b95af
Malware Config
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 3204 InstallUtil.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
powershell.exepid process 964 powershell.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/8-122-0x0000000007310000-0x0000000007331000-memory.dmp agile_net behavioral1/memory/8-125-0x0000000005EB0000-0x00000000063AE000-memory.dmp agile_net -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exedescription pid process target process PID 8 set thread context of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe -
Drops file in Windows directory 8 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe 964 powershell.exe 964 powershell.exe 964 powershell.exe 4028 powershell.exe 4028 powershell.exe 4028 powershell.exe 1476 powershell.exe 1476 powershell.exe 1476 powershell.exe 4028 powershell.exe 4028 powershell.exe 4028 powershell.exe 964 powershell.exe 964 powershell.exe 964 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 636 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe Token: SeDebugPrivilege 964 powershell.exe Token: SeDebugPrivilege 4028 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 4028 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exeInstallUtil.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.exedescription pid process target process PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 8 wrote to memory of 3204 8 f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe InstallUtil.exe PID 3204 wrote to memory of 964 3204 InstallUtil.exe powershell.exe PID 3204 wrote to memory of 964 3204 InstallUtil.exe powershell.exe PID 3204 wrote to memory of 964 3204 InstallUtil.exe powershell.exe PID 964 wrote to memory of 1636 964 powershell.exe csc.exe PID 964 wrote to memory of 1636 964 powershell.exe csc.exe PID 964 wrote to memory of 1636 964 powershell.exe csc.exe PID 1636 wrote to memory of 1512 1636 csc.exe cvtres.exe PID 1636 wrote to memory of 1512 1636 csc.exe cvtres.exe PID 1636 wrote to memory of 1512 1636 csc.exe cvtres.exe PID 964 wrote to memory of 4028 964 powershell.exe powershell.exe PID 964 wrote to memory of 4028 964 powershell.exe powershell.exe PID 964 wrote to memory of 4028 964 powershell.exe powershell.exe PID 964 wrote to memory of 1476 964 powershell.exe powershell.exe PID 964 wrote to memory of 1476 964 powershell.exe powershell.exe PID 964 wrote to memory of 1476 964 powershell.exe powershell.exe PID 964 wrote to memory of 4028 964 powershell.exe powershell.exe PID 964 wrote to memory of 4028 964 powershell.exe powershell.exe PID 964 wrote to memory of 4028 964 powershell.exe powershell.exe PID 964 wrote to memory of 1488 964 powershell.exe reg.exe PID 964 wrote to memory of 1488 964 powershell.exe reg.exe PID 964 wrote to memory of 1488 964 powershell.exe reg.exe PID 964 wrote to memory of 680 964 powershell.exe reg.exe PID 964 wrote to memory of 680 964 powershell.exe reg.exe PID 964 wrote to memory of 680 964 powershell.exe reg.exe PID 964 wrote to memory of 1864 964 powershell.exe reg.exe PID 964 wrote to memory of 1864 964 powershell.exe reg.exe PID 964 wrote to memory of 1864 964 powershell.exe reg.exe PID 964 wrote to memory of 2068 964 powershell.exe net.exe PID 964 wrote to memory of 2068 964 powershell.exe net.exe PID 964 wrote to memory of 2068 964 powershell.exe net.exe PID 2068 wrote to memory of 1972 2068 net.exe net1.exe PID 2068 wrote to memory of 1972 2068 net.exe net1.exe PID 2068 wrote to memory of 1972 2068 net.exe net1.exe PID 964 wrote to memory of 2304 964 powershell.exe cmd.exe PID 964 wrote to memory of 2304 964 powershell.exe cmd.exe PID 964 wrote to memory of 2304 964 powershell.exe cmd.exe PID 2304 wrote to memory of 2284 2304 cmd.exe cmd.exe PID 2304 wrote to memory of 2284 2304 cmd.exe cmd.exe PID 2304 wrote to memory of 2284 2304 cmd.exe cmd.exe PID 2284 wrote to memory of 2196 2284 cmd.exe net.exe PID 2284 wrote to memory of 2196 2284 cmd.exe net.exe PID 2284 wrote to memory of 2196 2284 cmd.exe net.exe PID 2196 wrote to memory of 1724 2196 net.exe net1.exe PID 2196 wrote to memory of 1724 2196 net.exe net1.exe PID 2196 wrote to memory of 1724 2196 net.exe net1.exe PID 964 wrote to memory of 1384 964 powershell.exe cmd.exe PID 964 wrote to memory of 1384 964 powershell.exe cmd.exe PID 964 wrote to memory of 1384 964 powershell.exe cmd.exe PID 1384 wrote to memory of 3264 1384 cmd.exe cmd.exe PID 1384 wrote to memory of 3264 1384 cmd.exe cmd.exe PID 1384 wrote to memory of 3264 1384 cmd.exe cmd.exe PID 3264 wrote to memory of 3512 3264 cmd.exe net.exe PID 3264 wrote to memory of 3512 3264 cmd.exe net.exe PID 3264 wrote to memory of 3512 3264 cmd.exe net.exe PID 3512 wrote to memory of 3004 3512 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe"C:\Users\Admin\AppData\Local\Temp\f464dae032967264173885899186be9eac89bd2016ded5ebc38c705fa6b1b625.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'3⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\swwk0kcn\swwk0kcn.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A3B.tmp" "c:\Users\Admin\AppData\Local\Temp\swwk0kcn\CSCBA413C0FAB3444CF8999DAC8421F5270.TMP"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f4⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c net start rdpdr5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start rdpdr6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rdpdr7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c net start TermService5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start TermService6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
f3068198b62b4b70404ec46694d632be
SHA17b0b31ae227cf2a78cb751573a9d07f755104ea0
SHA256bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8
SHA512ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\RES8A3B.tmpMD5
74fdd77256dbae9936f534fd868c1691
SHA19a50a2d83c6d083ba8bdbc63eec43fca7392ab1b
SHA2569232edad12f6b23631f775dfedd550a4f99b8ba4a4ae6d389eed731794ef7298
SHA51246ad0457d612289489081ae396a66e2cbccded81f3f99b6913dc5eeff18995f6576518335836807f932919cd010f00e49d396cb8892480a085f131a3b27e4e6b
-
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1MD5
841cc93778b4ec353d0075d717b90df4
SHA1287f652b7be199d127aab4655055654a6ea2bed6
SHA25677f2e15c057346682081eae41389c9d91ba710c2f91107a9c59543c71cf6cad1
SHA512a98053ebe4279d8b312a27f634ca2a9b4d929e15f8d27bdb2e89706a9fa967035e58a5d5cec2be0e5ea763b8c278884863f91d8ca270d4a30a20c51d00b72541
-
C:\Users\Admin\AppData\Local\Temp\ready.ps1MD5
28d9755addec05c0b24cca50dfe3a92b
SHA17d3156f11c7a7fb60d29809caf93101de2681aa3
SHA256abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9
SHA512891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42
-
C:\Users\Admin\AppData\Local\Temp\swwk0kcn\swwk0kcn.dllMD5
3fcf5d97205d4e54ed27c48969dd2edf
SHA1c6f6a8257eb07ad8faa0cddda2184cbd0cb20386
SHA2560aa1e26a75d0bd0f5addc452d7de982994a7fda6b6f2b39837542775b5763178
SHA51241330341ebe3fb32789ec8276c1c9561e293a87051a82f0c95fc2c8982dda9e1d5292cb6065df5b717099e81de56988927ddfc07656f34c299d6cc8e86f27431
-
\??\c:\Users\Admin\AppData\Local\Temp\swwk0kcn\CSCBA413C0FAB3444CF8999DAC8421F5270.TMPMD5
5b8f4d9d052c59a3c243f3932e7129d8
SHA1a33174f589e654a8419e22eb67b74fce04110106
SHA256b46a5717e92c18cb86008ef864c1ce72cd3543318e450ffac266ed5b2654d3eb
SHA512c6a942dd4549a23f89665cef04b539130fdf7766c54dcc861a81185af9887071bfe0836e048e1af4eaba052820aa4d38d745bc29b463edcfe5db9ba68017e911
-
\??\c:\Users\Admin\AppData\Local\Temp\swwk0kcn\swwk0kcn.0.csMD5
9f8ab7eb0ab21443a2fe06dab341510e
SHA12b88b3116a79e48bab7114e18c9b9674e8a52165
SHA256e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9
SHA51253f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b
-
\??\c:\Users\Admin\AppData\Local\Temp\swwk0kcn\swwk0kcn.cmdlineMD5
9ee719edb0e2688c9f340e42d7751e60
SHA1d37f8da59b7ab98dbce0e7c71ccae22e04626440
SHA2564f7d669c22448d53e43d2b8135ff08f68e546e78a0d9315f5fa2ebd85752624c
SHA51299bec8f155d8bddcd88fa45d66dfdca27c5814cd206fad9134d742d868c211a34aadaacf4732e4fa13d106c8d94d8d6dcfd212f119d8b2923edfc6050b1030cc
-
memory/8-126-0x0000000003860000-0x000000000386B000-memory.dmpFilesize
44KB
-
memory/8-127-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/8-125-0x0000000005EB0000-0x00000000063AE000-memory.dmpFilesize
5.0MB
-
memory/8-124-0x0000000007370000-0x0000000007371000-memory.dmpFilesize
4KB
-
memory/8-123-0x00000000073B0000-0x00000000073B1000-memory.dmpFilesize
4KB
-
memory/8-122-0x0000000007310000-0x0000000007331000-memory.dmpFilesize
132KB
-
memory/8-121-0x0000000005EB0000-0x00000000063AE000-memory.dmpFilesize
5.0MB
-
memory/8-115-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/8-120-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/8-119-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/8-118-0x0000000005DE0000-0x0000000005DE1000-memory.dmpFilesize
4KB
-
memory/8-117-0x00000000063B0000-0x00000000063B1000-memory.dmpFilesize
4KB
-
memory/680-985-0x0000000000000000-mapping.dmp
-
memory/964-175-0x0000000007690000-0x0000000007691000-memory.dmpFilesize
4KB
-
memory/964-158-0x0000000008200000-0x0000000008201000-memory.dmpFilesize
4KB
-
memory/964-148-0x0000000003730000-0x0000000003731000-memory.dmpFilesize
4KB
-
memory/964-149-0x0000000003730000-0x0000000003731000-memory.dmpFilesize
4KB
-
memory/964-150-0x00000000073C0000-0x00000000073C1000-memory.dmpFilesize
4KB
-
memory/964-151-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/964-152-0x00000000080E0000-0x00000000080E1000-memory.dmpFilesize
4KB
-
memory/964-153-0x0000000008260000-0x0000000008261000-memory.dmpFilesize
4KB
-
memory/964-155-0x0000000008440000-0x0000000008441000-memory.dmpFilesize
4KB
-
memory/964-156-0x0000000007430000-0x0000000007431000-memory.dmpFilesize
4KB
-
memory/964-157-0x0000000007432000-0x0000000007433000-memory.dmpFilesize
4KB
-
memory/964-147-0x0000000000000000-mapping.dmp
-
memory/964-159-0x0000000008BD0000-0x0000000008BD1000-memory.dmpFilesize
4KB
-
memory/964-160-0x0000000008B50000-0x0000000008B51000-memory.dmpFilesize
4KB
-
memory/964-177-0x0000000007433000-0x0000000007434000-memory.dmpFilesize
4KB
-
memory/964-162-0x0000000003730000-0x0000000003731000-memory.dmpFilesize
4KB
-
memory/964-166-0x000000000A030000-0x000000000A031000-memory.dmpFilesize
4KB
-
memory/964-167-0x0000000009880000-0x0000000009881000-memory.dmpFilesize
4KB
-
memory/964-198-0x0000000009C60000-0x0000000009C61000-memory.dmpFilesize
4KB
-
memory/964-1082-0x000000007F6F0000-0x000000007F6F1000-memory.dmpFilesize
4KB
-
memory/1384-1031-0x0000000000000000-mapping.dmp
-
memory/1476-464-0x0000000004EF2000-0x0000000004EF3000-memory.dmpFilesize
4KB
-
memory/1476-454-0x0000000000000000-mapping.dmp
-
memory/1476-489-0x000000007E820000-0x000000007E821000-memory.dmpFilesize
4KB
-
memory/1476-463-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/1488-984-0x0000000000000000-mapping.dmp
-
memory/1512-171-0x0000000000000000-mapping.dmp
-
memory/1636-168-0x0000000000000000-mapping.dmp
-
memory/1724-1030-0x0000000000000000-mapping.dmp
-
memory/1864-986-0x0000000000000000-mapping.dmp
-
memory/1972-1024-0x0000000000000000-mapping.dmp
-
memory/2068-1023-0x0000000000000000-mapping.dmp
-
memory/2196-1029-0x0000000000000000-mapping.dmp
-
memory/2284-1028-0x0000000000000000-mapping.dmp
-
memory/2304-1027-0x0000000000000000-mapping.dmp
-
memory/2952-1050-0x0000000000000000-mapping.dmp
-
memory/3004-1034-0x0000000000000000-mapping.dmp
-
memory/3204-142-0x0000000005272000-0x0000000005273000-memory.dmpFilesize
4KB
-
memory/3204-129-0x000000000040330C-mapping.dmp
-
memory/3204-131-0x0000000000960000-0x0000000000D6B000-memory.dmpFilesize
4.0MB
-
memory/3204-138-0x0000000005690000-0x0000000005A8F000-memory.dmpFilesize
4.0MB
-
memory/3204-136-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/3204-141-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/3204-134-0x0000000000960000-0x0000000000D6B000-memory.dmpFilesize
4.0MB
-
memory/3204-143-0x0000000005273000-0x0000000005274000-memory.dmpFilesize
4KB
-
memory/3204-144-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/3204-146-0x0000000005274000-0x0000000005275000-memory.dmpFilesize
4KB
-
memory/3264-1032-0x0000000000000000-mapping.dmp
-
memory/3512-1033-0x0000000000000000-mapping.dmp
-
memory/3776-1049-0x0000000000000000-mapping.dmp
-
memory/4028-201-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/4028-814-0x000000007EBA0000-0x000000007EBA1000-memory.dmpFilesize
4KB
-
memory/4028-719-0x0000000004DB2000-0x0000000004DB3000-memory.dmpFilesize
4KB
-
memory/4028-718-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/4028-705-0x0000000000000000-mapping.dmp
-
memory/4028-229-0x000000007EEC0000-0x000000007EEC1000-memory.dmpFilesize
4KB
-
memory/4028-209-0x0000000007032000-0x0000000007033000-memory.dmpFilesize
4KB
-
memory/4028-208-0x0000000007030000-0x0000000007031000-memory.dmpFilesize
4KB
-
memory/4028-200-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/4028-199-0x0000000000000000-mapping.dmp