servhelper | ee5d82cd5e61b518572b4415797ee407cff1d28a2e0b43a2baec7236c37695eb

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb3cc551561883ab8fc4fb6fc837a469_JaffaCakes118.exe
Size

4.0MB
MD5

cb3cc551561883ab8fc4fb6fc837a469
SHA1

f74ae6d243342099d3fa500cbc630f4a244a8d82
SHA256

ee5d82cd5e61b518572b4415797ee407cff1d28a2e0b43a2baec7236c37695eb
SHA512

b97782f7835949ec41da357cfba598936bc2542fa53c0c8da7f35168f4f0fe19158a5946a297dcc540b7ce0dda8aeacd06f69ac209bd562e58fb31924e8fd7d1
SSDEEP

49152:MgG+0nnFa5xF1Azk6GehC1Vm6ctA6Ty0pQJb4Qate1YdM1TGHgzBut:M

Score

10^/10

servhelper backdoor discovery exploit persistence trojan

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2112	icacls.exe
2820	icacls.exe
1892	icacls.exe
2064	icacls.exe
3636	icacls.exe
4684	takeown.exe
2148	icacls.exe
4508	icacls.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1892	icacls.exe
2064	icacls.exe
3636	icacls.exe
4684	takeown.exe
2148	icacls.exe
4508	icacls.exe
2112	icacls.exe
2820	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe
File created	C:\Windows\SysWOW64\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1984	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5092	powershell.exe
5092	powershell.exe
1480	powershell.exe
1480	powershell.exe
2848	powershell.exe
2848	powershell.exe
2332	powershell.exe
2332	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeRestorePrivilege	4508	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5092	3332	cb3cc551561883ab8fc4fb6fc837a469_JaffaCakes118.exe	91
PID 3332 wrote to memory of 5092	3332	cb3cc551561883ab8fc4fb6fc837a469_JaffaCakes118.exe	91
PID 3332 wrote to memory of 5092	3332	cb3cc551561883ab8fc4fb6fc837a469_JaffaCakes118.exe	91
PID 5092 wrote to memory of 3636	5092	powershell.exe	94
PID 5092 wrote to memory of 3636	5092	powershell.exe	94
PID 5092 wrote to memory of 3636	5092	powershell.exe	94
PID 3636 wrote to memory of 1340	3636	csc.exe	97
PID 3636 wrote to memory of 1340	3636	csc.exe	97
PID 3636 wrote to memory of 1340	3636	csc.exe	97
PID 5092 wrote to memory of 1480	5092	powershell.exe	98
PID 5092 wrote to memory of 1480	5092	powershell.exe	98
PID 5092 wrote to memory of 1480	5092	powershell.exe	98
PID 5092 wrote to memory of 2848	5092	powershell.exe	100
PID 5092 wrote to memory of 2848	5092	powershell.exe	100
PID 5092 wrote to memory of 2848	5092	powershell.exe	100
PID 5092 wrote to memory of 2332	5092	powershell.exe	102
PID 5092 wrote to memory of 2332	5092	powershell.exe	102
PID 5092 wrote to memory of 2332	5092	powershell.exe	102
PID 5092 wrote to memory of 4684	5092	powershell.exe	105
PID 5092 wrote to memory of 4684	5092	powershell.exe	105
PID 5092 wrote to memory of 4684	5092	powershell.exe	105
PID 5092 wrote to memory of 2148	5092	powershell.exe	106
PID 5092 wrote to memory of 2148	5092	powershell.exe	106
PID 5092 wrote to memory of 2148	5092	powershell.exe	106
PID 5092 wrote to memory of 4508	5092	powershell.exe	107
PID 5092 wrote to memory of 4508	5092	powershell.exe	107
PID 5092 wrote to memory of 4508	5092	powershell.exe	107
PID 5092 wrote to memory of 2112	5092	powershell.exe	108
PID 5092 wrote to memory of 2112	5092	powershell.exe	108
PID 5092 wrote to memory of 2112	5092	powershell.exe	108
PID 5092 wrote to memory of 2820	5092	powershell.exe	109
PID 5092 wrote to memory of 2820	5092	powershell.exe	109
PID 5092 wrote to memory of 2820	5092	powershell.exe	109
PID 5092 wrote to memory of 1892	5092	powershell.exe	110
PID 5092 wrote to memory of 1892	5092	powershell.exe	110
PID 5092 wrote to memory of 1892	5092	powershell.exe	110
PID 5092 wrote to memory of 2064	5092	powershell.exe	111
PID 5092 wrote to memory of 2064	5092	powershell.exe	111
PID 5092 wrote to memory of 2064	5092	powershell.exe	111
PID 5092 wrote to memory of 3636	5092	powershell.exe	112
PID 5092 wrote to memory of 3636	5092	powershell.exe	112
PID 5092 wrote to memory of 3636	5092	powershell.exe	112
PID 5092 wrote to memory of 3608	5092	powershell.exe	113
PID 5092 wrote to memory of 3608	5092	powershell.exe	113
PID 5092 wrote to memory of 3608	5092	powershell.exe	113
PID 5092 wrote to memory of 1984	5092	powershell.exe	114
PID 5092 wrote to memory of 1984	5092	powershell.exe	114
PID 5092 wrote to memory of 1984	5092	powershell.exe	114
PID 5092 wrote to memory of 4084	5092	powershell.exe	115
PID 5092 wrote to memory of 4084	5092	powershell.exe	115
PID 5092 wrote to memory of 4084	5092	powershell.exe	115
PID 5092 wrote to memory of 2340	5092	powershell.exe	116
PID 5092 wrote to memory of 2340	5092	powershell.exe	116
PID 5092 wrote to memory of 2340	5092	powershell.exe	116
PID 2340 wrote to memory of 3068	2340	net.exe	117
PID 2340 wrote to memory of 3068	2340	net.exe	117
PID 2340 wrote to memory of 3068	2340	net.exe	117
PID 5092 wrote to memory of 5096	5092	powershell.exe	118
PID 5092 wrote to memory of 5096	5092	powershell.exe	118
PID 5092 wrote to memory of 5096	5092	powershell.exe	118
PID 5096 wrote to memory of 3968	5096	cmd.exe	119
PID 5096 wrote to memory of 3968	5096	cmd.exe	119
PID 5096 wrote to memory of 3968	5096	cmd.exe	119
PID 3968 wrote to memory of 224	3968	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\cb3cc551561883ab8fc4fb6fc837a469_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cb3cc551561883ab8fc4fb6fc837a469_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hkebzj0b\hkebzj0b.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8BE.tmp" "c:\Users\Admin\AppData\Local\Temp\hkebzj0b\CSCB48E594DDE1644258116C5674D749743.TMP"
      4⤵
      PID:1340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4684
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2148
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2112
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2820
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1892
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2064
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Sets DLL path for service in the registry
    - Modifies registry key
    PID:1984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:4084
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:224
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:3368
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:1616
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
e2e6bbdcc5cb2b2a8e58e62380cbdeeb

SHA1
fd3b0bbf8d08573d022e54ceb111e4dfe93ff752

SHA256
2cf90543f0e785093db02f3ce60471d639ec8e5030a2ea0d70187ce55c248cf2

SHA512
82ff827ccb3eb01f00713dfcf4d2ef8107c86d206698a366293bb723e36d9a20dba44c818d40e79824fd72c76987e71d69565a3079bccaaa0626d64a13014317

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC8BE.tmp

Filesize
1KB

MD5
e2ff148a195602967a078ffa782d563e

SHA1
e6f8436b141fd4a67b835ac01d4db9ac91430d87

SHA256
27145f5a87f8447c15d9e5a4d1febceb56da0933d28fa8f233262dc116065374

SHA512
eb84de59250991956af5d1fd5e52c6587040db967493e9f3c84ef98161055758ec1607ff24fa8bf36208dd1a25aa4076ebb63e5a73ae863c19bed9d0ee3cfb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3eop0myz.x5o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

Filesize
2.5MB

MD5
841cc93778b4ec353d0075d717b90df4

SHA1
287f652b7be199d127aab4655055654a6ea2bed6

SHA256
77f2e15c057346682081eae41389c9d91ba710c2f91107a9c59543c71cf6cad1

SHA512
a98053ebe4279d8b312a27f634ca2a9b4d929e15f8d27bdb2e89706a9fa967035e58a5d5cec2be0e5ea763b8c278884863f91d8ca270d4a30a20c51d00b72541

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkebzj0b\hkebzj0b.dll

Filesize
3KB

MD5
09102fe0b7e6302f160ab0fcde307c4b

SHA1
2b7a7bca1a5ac90613abad1941aa3d25c5288831

SHA256
fc08a3e14a7b6f71ca88cc749905934e63eb813c22d765aa6a3c84b61a75cfeb

SHA512
5cc111e0ee3b0f7f841456cf26f2593fdf5dad705c61829af2c775a3fd5e5b27345d911f64aac2d156be3942eede99512248e6f5aab9d07e6e3b2ce71c3f6ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

Filesize
1KB

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Windows\SysWOW64\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hkebzj0b\CSCB48E594DDE1644258116C5674D749743.TMP

Filesize
652B

MD5
216a7f213b3840a471c20b967436ccc5

SHA1
cc95009d8a4be42486538345d9d33037c15c48ab

SHA256
ceb2031e43595541e82fd58c550b239b3203de44aaf02d8056b64ffbb65aa64c

SHA512
9c99222ec93600afbc555130c993a2ad4d6664cf1359b2be24d1d9515a823b2ec4af640c37dca036f2510c06fdbd85a64154d6dc70b73fd678de4bc07d9e7d38

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hkebzj0b\hkebzj0b.0.cs

Filesize
424B

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hkebzj0b\hkebzj0b.cmdline

Filesize
369B

MD5
947abf591dbf321409f38aeb2a3a3072

SHA1
9ac4db381c0a1c257d4886bfbc630c7e8469be82

SHA256
a888796c34418732d33663846092d16d9940d32d4f5ad2f2183024147f8be8db

SHA512
87aeb78d21518280d1c012d9bc115eed592e44025a8843fc745a4d11efee76ea35f26081240a2a72cf2e3d88f4eb9b148e1a06489ed2c82c41ca371b96c8826c

Download Submit
memory/1480-88-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/1480-80-0x0000000006F10000-0x0000000006F1A000-memory.dmp

Filesize
40KB

Download
memory/1480-67-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/1480-68-0x0000000070440000-0x0000000070794000-memory.dmp

Filesize
3.3MB

Download
memory/1480-78-0x0000000006A80000-0x0000000006A9E000-memory.dmp

Filesize
120KB

Download
memory/1480-79-0x0000000006D80000-0x0000000006E23000-memory.dmp

Filesize
652KB

Download
memory/1480-52-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/1480-51-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/1480-66-0x0000000006B40000-0x0000000006B72000-memory.dmp

Filesize
200KB

Download
memory/1480-87-0x00000000070F0000-0x00000000070F8000-memory.dmp

Filesize
32KB

Download
memory/1480-86-0x0000000007100000-0x000000000711A000-memory.dmp

Filesize
104KB

Download
memory/1480-81-0x0000000007150000-0x00000000071E6000-memory.dmp

Filesize
600KB

Download
memory/1480-84-0x00000000070C0000-0x00000000070D4000-memory.dmp

Filesize
80KB

Download
memory/1480-83-0x00000000070B0000-0x00000000070BE000-memory.dmp

Filesize
56KB

Download
memory/1480-82-0x0000000007070000-0x0000000007081000-memory.dmp

Filesize
68KB

Download
memory/2332-144-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2332-120-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/2332-132-0x000000007F4E0000-0x000000007F4F0000-memory.dmp

Filesize
64KB

Download
memory/2332-133-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/2332-134-0x0000000070440000-0x0000000070794000-memory.dmp

Filesize
3.3MB

Download
memory/2332-119-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/2332-130-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/2332-118-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2848-91-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/2848-90-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2848-117-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2848-93-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/2848-106-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/2848-107-0x0000000070440000-0x0000000070794000-memory.dmp

Filesize
3.3MB

Download
memory/3332-63-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-9-0x0000000007A70000-0x0000000007AD6000-memory.dmp

Filesize
408KB

Download
memory/3332-64-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-0-0x00000000002E0000-0x00000000006EB000-memory.dmp

Filesize
4.0MB

Download
memory/3332-53-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3332-1-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3332-2-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-3-0x0000000005CA0000-0x00000000060A4000-memory.dmp

Filesize
4.0MB

Download
memory/3332-4-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-65-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-85-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-5-0x0000000006650000-0x0000000006BF4000-memory.dmp

Filesize
5.6MB

Download
memory/3332-6-0x00000000062A0000-0x0000000006332000-memory.dmp

Filesize
584KB

Download
memory/3332-7-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/3332-8-0x0000000006460000-0x000000000646A000-memory.dmp

Filesize
40KB

Download
memory/5092-32-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/5092-12-0x00000000029A0000-0x00000000029D6000-memory.dmp

Filesize
216KB

Download
memory/5092-92-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/5092-16-0x0000000005310000-0x0000000005938000-memory.dmp

Filesize
6.2MB

Download
memory/5092-103-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/5092-105-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/5092-15-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/5092-14-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/5092-13-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-17-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Filesize
136KB

Download
memory/5092-18-0x0000000005150000-0x00000000051B6000-memory.dmp

Filesize
408KB

Download
memory/5092-89-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-28-0x00000000059C0000-0x0000000005D14000-memory.dmp

Filesize
3.3MB

Download
memory/5092-29-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/5092-30-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Filesize
304KB

Download
memory/5092-33-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Filesize
6.5MB

Download
memory/5092-34-0x00000000064E0000-0x00000000064FA000-memory.dmp

Filesize
104KB

Download
memory/5092-47-0x0000000006550000-0x0000000006558000-memory.dmp

Filesize
32KB

Download
memory/5092-145-0x0000000007510000-0x0000000007532000-memory.dmp

Filesize
136KB

Download
memory/5092-50-0x0000000007250000-0x000000000727C000-memory.dmp

Filesize
176KB

Download