servhelper | c6d19a50de0ff5674c48106227234f3e9d5231e97a79cf51dd137042b7444ba5

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37ee84f9933d943000195e804b3b7b75.exe
Size

4.1MB
MD5

37ee84f9933d943000195e804b3b7b75
SHA1

738f4e23ce5dd5c2c08de9cdb9ca99c0e4db90f5
SHA256

c6d19a50de0ff5674c48106227234f3e9d5231e97a79cf51dd137042b7444ba5
SHA512

fdb6f22c1adf37a6e6d11419c964859602f1db8ce3dcb2ec887570e168d47975a74b5a16e8af5da11d4de54e071e308a950ef3908def2f0612de3ac0b6fd73f2
SSDEEP

98304:l8Cirq4EmiHjDhIKuPU5Du+f+8Q4LuIa:lUrqzjDhOkGCTa

Score

10^/10

servhelper backdoor discovery exploit persistence trojan

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
1524	icacls.exe
3796	icacls.exe
4792	takeown.exe
3960	icacls.exe
1204	icacls.exe
3260	icacls.exe
3000	icacls.exe
4900	icacls.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3960	icacls.exe
1204	icacls.exe
3260	icacls.exe
4792	takeown.exe
3000	icacls.exe
4900	icacls.exe
1524	icacls.exe
3796	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe
File created	C:\Windows\SysWOW64\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2800	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4264	powershell.exe
4264	powershell.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
4264	powershell.exe
4264	powershell.exe
4264	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeRestorePrivilege	3000	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4264	4132	37ee84f9933d943000195e804b3b7b75.exe	94
PID 4132 wrote to memory of 4264	4132	37ee84f9933d943000195e804b3b7b75.exe	94
PID 4132 wrote to memory of 4264	4132	37ee84f9933d943000195e804b3b7b75.exe	94
PID 4264 wrote to memory of 4484	4264	powershell.exe	96
PID 4264 wrote to memory of 4484	4264	powershell.exe	96
PID 4264 wrote to memory of 4484	4264	powershell.exe	96
PID 4484 wrote to memory of 2280	4484	csc.exe	97
PID 4484 wrote to memory of 2280	4484	csc.exe	97
PID 4484 wrote to memory of 2280	4484	csc.exe	97
PID 4264 wrote to memory of 1924	4264	powershell.exe	99
PID 4264 wrote to memory of 1924	4264	powershell.exe	99
PID 4264 wrote to memory of 1924	4264	powershell.exe	99
PID 4264 wrote to memory of 2380	4264	powershell.exe	101
PID 4264 wrote to memory of 2380	4264	powershell.exe	101
PID 4264 wrote to memory of 2380	4264	powershell.exe	101
PID 4264 wrote to memory of 4432	4264	powershell.exe	103
PID 4264 wrote to memory of 4432	4264	powershell.exe	103
PID 4264 wrote to memory of 4432	4264	powershell.exe	103
PID 4264 wrote to memory of 4792	4264	powershell.exe	125
PID 4264 wrote to memory of 4792	4264	powershell.exe	125
PID 4264 wrote to memory of 4792	4264	powershell.exe	125
PID 4264 wrote to memory of 3260	4264	powershell.exe	124
PID 4264 wrote to memory of 3260	4264	powershell.exe	124
PID 4264 wrote to memory of 3260	4264	powershell.exe	124
PID 4264 wrote to memory of 3000	4264	powershell.exe	104
PID 4264 wrote to memory of 3000	4264	powershell.exe	104
PID 4264 wrote to memory of 3000	4264	powershell.exe	104
PID 4264 wrote to memory of 1204	4264	powershell.exe	123
PID 4264 wrote to memory of 1204	4264	powershell.exe	123
PID 4264 wrote to memory of 1204	4264	powershell.exe	123
PID 4264 wrote to memory of 3960	4264	powershell.exe	122
PID 4264 wrote to memory of 3960	4264	powershell.exe	122
PID 4264 wrote to memory of 3960	4264	powershell.exe	122
PID 4264 wrote to memory of 3796	4264	powershell.exe	121
PID 4264 wrote to memory of 3796	4264	powershell.exe	121
PID 4264 wrote to memory of 3796	4264	powershell.exe	121
PID 4264 wrote to memory of 1524	4264	powershell.exe	120
PID 4264 wrote to memory of 1524	4264	powershell.exe	120
PID 4264 wrote to memory of 1524	4264	powershell.exe	120
PID 4264 wrote to memory of 4900	4264	powershell.exe	108
PID 4264 wrote to memory of 4900	4264	powershell.exe	108
PID 4264 wrote to memory of 4900	4264	powershell.exe	108
PID 4264 wrote to memory of 836	4264	powershell.exe	107
PID 4264 wrote to memory of 836	4264	powershell.exe	107
PID 4264 wrote to memory of 836	4264	powershell.exe	107
PID 4264 wrote to memory of 2800	4264	powershell.exe	106
PID 4264 wrote to memory of 2800	4264	powershell.exe	106
PID 4264 wrote to memory of 2800	4264	powershell.exe	106
PID 4264 wrote to memory of 2652	4264	powershell.exe	105
PID 4264 wrote to memory of 2652	4264	powershell.exe	105
PID 4264 wrote to memory of 2652	4264	powershell.exe	105
PID 4264 wrote to memory of 2164	4264	powershell.exe	119
PID 4264 wrote to memory of 2164	4264	powershell.exe	119
PID 4264 wrote to memory of 2164	4264	powershell.exe	119
PID 2164 wrote to memory of 840	2164	net.exe	109
PID 2164 wrote to memory of 840	2164	net.exe	109
PID 2164 wrote to memory of 840	2164	net.exe	109
PID 4264 wrote to memory of 532	4264	powershell.exe	110
PID 4264 wrote to memory of 532	4264	powershell.exe	110
PID 4264 wrote to memory of 532	4264	powershell.exe	110
PID 532 wrote to memory of 2924	532	cmd.exe	118
PID 532 wrote to memory of 2924	532	cmd.exe	118
PID 532 wrote to memory of 2924	532	cmd.exe	118
PID 2924 wrote to memory of 3444	2924	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\37ee84f9933d943000195e804b3b7b75.exe
"C:\Users\Admin\AppData\Local\Temp\37ee84f9933d943000195e804b3b7b75.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0k1kgvcf\0k1kgvcf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AF1.tmp" "c:\Users\Admin\AppData\Local\Temp\0k1kgvcf\CSCB47FA57864144837995353C42B7EFA8C.TMP"
      4⤵
      PID:2280
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Sets DLL path for service in the registry
    - Modifies registry key
    PID:2800
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:836
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:4048
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2164
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1524
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3796
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3960
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1204
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3260
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
1⤵
PID:840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
1⤵
PID:2820

C:\Windows\SysWOW64\net.exe
net start TermService
1⤵
PID:1004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
1⤵
PID:1140

C:\Windows\SysWOW64\net.exe
net start rdpdr
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0k1kgvcf\0k1kgvcf.dll

Filesize
3KB

MD5
d39ab8212383b95d2b7200194c21d54a

SHA1
1eee79fa40f2e1b85f8e242b38f0e6a5a09e574b

SHA256
7a326e08939c027c352237a74608892bd7ef69114c079ee45dc2e7a87d42414e

SHA512
6e30e6b6cf927eb01533394b99433c2263f1ce0f3bf7fbec0e79a0ee5f764422d9792fb11e834a4ee7e44f60f989327c6dacd955961f6da085cdc0b121980309

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5AF1.tmp

Filesize
1KB

MD5
d2b1cd30ee4fb96d9d654b11c042aea5

SHA1
a50fa521e5485c8b341e7c558c14517ad12ec0b8

SHA256
d83d5ac2a491ba8559cc415d7b2ca2c7b08c39d7c21472f66f5f28c3dd490393

SHA512
09af8767c4d4499f852f61ff4d24f06804ba870754e24a1e2ae557a793793637b539b7961bd2913ec8dc9ec490553ea66108a03ee9953efc915ca9140d7155eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zk1ejzwa.blp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

Filesize
101KB

MD5
1e03ef5bd509e9914e76ed214f4bc01d

SHA1
5535f7fc77fc252bdf8e494127ad9379776ffb31

SHA256
91695da5dc9af2b5faa087d7fba2e2665b724e3f5d03955d58d538d43e74f071

SHA512
dea2ff8186c90335a8faf5dd8fc943d24348f30c9cf312f653f1760b9afa2ea46b76474efaac077592ba4439e6fe4a68dea418ed51b451f667c5585cdeeb7e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

Filesize
1KB

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Windows\SysWOW64\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0k1kgvcf\0k1kgvcf.0.cs

Filesize
424B

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0k1kgvcf\0k1kgvcf.cmdline

Filesize
369B

MD5
0c48310200277d8e4ccf511a599f6cf8

SHA1
4ce32c39a6ff04819c782830c256980a191c7690

SHA256
02efb87fd033cc07d502913e6908839dccc871d48f5ab1a203525121983377a4

SHA512
ac91af18736681ba2b547649702a981771921581c7848e17cdd6e614c8499a44afe0211a9247a0cfd343784f8193381a04013828657190883828a302308b148a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0k1kgvcf\CSCB47FA57864144837995353C42B7EFA8C.TMP

Filesize
652B

MD5
fa54730d53c7475de02049175099128b

SHA1
0b8fb74135ed051360a1bda61a0dc015a5b04f7e

SHA256
7fa063a77515ea9ababa4bbe34a3842d6a3b68b43fe474779446de60921d60c5

SHA512
988ad2e531f0260e92b59d257e84672aaa197cb7c5857ddb863badd99a3d646b6740310027e37e66d0bdd62719a2b8b4e0a2b2489d574610646a3457f6e15330

Download Submit
memory/1924-93-0x0000000006E70000-0x0000000006E84000-memory.dmp

Filesize
80KB

Download
memory/1924-94-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

Filesize
104KB

Download
memory/1924-92-0x0000000006E60000-0x0000000006E6E000-memory.dmp

Filesize
56KB

Download
memory/1924-96-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/1924-95-0x0000000006EA0000-0x0000000006EA8000-memory.dmp

Filesize
32KB

Download
memory/1924-68-0x000000007FD60000-0x000000007FD70000-memory.dmp

Filesize
64KB

Download
memory/1924-71-0x0000000006A90000-0x0000000006AC2000-memory.dmp

Filesize
200KB

Download
memory/1924-91-0x0000000006E20000-0x0000000006E31000-memory.dmp

Filesize
68KB

Download
memory/1924-90-0x0000000006F00000-0x0000000006F96000-memory.dmp

Filesize
600KB

Download
memory/1924-89-0x0000000006CC0000-0x0000000006CCA000-memory.dmp

Filesize
40KB

Download
memory/1924-74-0x000000006FA40000-0x000000006FD94000-memory.dmp

Filesize
3.3MB

Download
memory/1924-85-0x0000000006AD0000-0x0000000006AEE000-memory.dmp

Filesize
120KB

Download
memory/1924-86-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/1924-88-0x0000000006B00000-0x0000000006BA3000-memory.dmp

Filesize
652KB

Download
memory/1924-87-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/1924-73-0x000000006F9E0000-0x000000006FA2C000-memory.dmp

Filesize
304KB

Download
memory/1924-54-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/1924-61-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/1924-60-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/2380-122-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/2380-98-0x0000000001680000-0x0000000001690000-memory.dmp

Filesize
64KB

Download
memory/2380-97-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/2380-108-0x000000006F9E0000-0x000000006FA2C000-memory.dmp

Filesize
304KB

Download
memory/2380-109-0x000000006FA40000-0x000000006FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2380-121-0x0000000001680000-0x0000000001690000-memory.dmp

Filesize
64KB

Download
memory/4132-53-0x00000000028E0000-0x0000000002CF3000-memory.dmp

Filesize
4.1MB

Download
memory/4132-12-0x0000000008530000-0x0000000008596000-memory.dmp

Filesize
408KB

Download
memory/4132-66-0x0000000002D00000-0x0000000003102000-memory.dmp

Filesize
4.0MB

Download
memory/4132-8-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/4132-69-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/4132-2-0x0000000002D00000-0x0000000003102000-memory.dmp

Filesize
4.0MB

Download
memory/4132-7-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/4132-3-0x00000000075D0000-0x00000000079D4000-memory.dmp

Filesize
4.0MB

Download
memory/4132-4-0x00000000079D0000-0x0000000007F74000-memory.dmp

Filesize
5.6MB

Download
memory/4132-9-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/4132-84-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/4132-6-0x0000000000400000-0x0000000002540000-memory.dmp

Filesize
33.2MB

Download
memory/4132-5-0x0000000008080000-0x0000000008112000-memory.dmp

Filesize
584KB

Download
memory/4132-72-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/4132-10-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/4132-11-0x00000000082F0000-0x00000000082FA000-memory.dmp

Filesize
40KB

Download
memory/4132-1-0x00000000028E0000-0x0000000002CF3000-memory.dmp

Filesize
4.1MB

Download
memory/4132-70-0x00000000034F0000-0x0000000003500000-memory.dmp

Filesize
64KB

Download
memory/4264-36-0x0000000006210000-0x000000000622A000-memory.dmp

Filesize
104KB

Download
memory/4264-120-0x0000000004850000-0x0000000004860000-memory.dmp

Filesize
64KB

Download
memory/4264-18-0x0000000004850000-0x0000000004860000-memory.dmp

Filesize
64KB

Download
memory/4264-17-0x0000000004E90000-0x00000000054B8000-memory.dmp

Filesize
6.2MB

Download
memory/4264-21-0x00000000054C0000-0x0000000005526000-memory.dmp

Filesize
408KB

Download
memory/4264-31-0x0000000005810000-0x0000000005B64000-memory.dmp

Filesize
3.3MB

Download
memory/4264-20-0x0000000004D20000-0x0000000004D42000-memory.dmp

Filesize
136KB

Download
memory/4264-15-0x0000000004750000-0x0000000004786000-memory.dmp

Filesize
216KB

Download
memory/4264-16-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/4264-32-0x0000000005CD0000-0x0000000005CEE000-memory.dmp

Filesize
120KB

Download
memory/4264-33-0x0000000005D80000-0x0000000005DCC000-memory.dmp

Filesize
304KB

Download
memory/4264-19-0x0000000004850000-0x0000000004860000-memory.dmp

Filesize
64KB

Download
memory/4264-49-0x0000000006280000-0x0000000006288000-memory.dmp

Filesize
32KB

Download
memory/4264-119-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/4264-35-0x0000000007330000-0x00000000079AA000-memory.dmp

Filesize
6.5MB

Download
memory/4264-52-0x0000000006FA0000-0x0000000006FCC000-memory.dmp

Filesize
176KB

Download
memory/4264-124-0x0000000004850000-0x0000000004860000-memory.dmp

Filesize
64KB

Download
memory/4432-123-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/4432-136-0x000000006F9E0000-0x000000006FA2C000-memory.dmp

Filesize
304KB

Download
memory/4432-135-0x000000007F680000-0x000000007F690000-memory.dmp

Filesize
64KB

Download
memory/4432-125-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download