Analysis
-
max time kernel
300s -
max time network
199s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-05-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe
Resource
win10-20220414-en
General
-
Target
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe
-
Size
16KB
-
MD5
23c8b23571c065c1d8c65beb2899cc42
-
SHA1
fd7f51575ccaeba2cd6cb0d2195e2be966c0fecf
-
SHA256
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2
-
SHA512
af1df92b60d1cff475deb7688b7a8baff26feb240a0d48a9cd73df3d1a5b9acff72d353f686de259d3bd77c0df1a7f7b269434789189a26c46a02313bdb5e64c
Malware Config
Signatures
-
CobaltStrike 1 IoCs
CobaltStrike.
Processes:
resource yara_rule behavioral2/memory/3248-307-0x00000000096D0000-0x0000000009775000-memory.dmp cobalt_strike_tmp01925d3f -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
dllhost.exepid process 2052 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2112 schtasks.exe 2148 schtasks.exe 4092 schtasks.exe 3860 schtasks.exe 1860 schtasks.exe 740 schtasks.exe 2172 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exedllhost.exepid process 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 1424 powershell.exe 1424 powershell.exe 1424 powershell.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe 2052 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exe932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 3248 powershell.exe Token: SeDebugPrivilege 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 2052 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.execmd.exedllhost.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3768 wrote to memory of 1888 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe cmd.exe PID 3768 wrote to memory of 1888 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe cmd.exe PID 3768 wrote to memory of 1888 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe cmd.exe PID 1888 wrote to memory of 744 1888 cmd.exe chcp.com PID 1888 wrote to memory of 744 1888 cmd.exe chcp.com PID 1888 wrote to memory of 744 1888 cmd.exe chcp.com PID 1888 wrote to memory of 3248 1888 cmd.exe powershell.exe PID 1888 wrote to memory of 3248 1888 cmd.exe powershell.exe PID 1888 wrote to memory of 3248 1888 cmd.exe powershell.exe PID 1888 wrote to memory of 1424 1888 cmd.exe powershell.exe PID 1888 wrote to memory of 1424 1888 cmd.exe powershell.exe PID 1888 wrote to memory of 1424 1888 cmd.exe powershell.exe PID 3768 wrote to memory of 2052 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe dllhost.exe PID 3768 wrote to memory of 2052 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe dllhost.exe PID 3768 wrote to memory of 2052 3768 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe dllhost.exe PID 2052 wrote to memory of 1284 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 1284 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 1284 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3836 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3836 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3836 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 1292 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 1292 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 1292 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 716 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 716 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 716 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3024 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3024 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3024 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2268 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2268 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2268 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3248 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3248 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3248 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3188 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3188 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3188 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3560 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3560 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3560 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2004 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2004 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2004 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2780 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2780 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 2780 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3448 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3448 2052 dllhost.exe cmd.exe PID 2052 wrote to memory of 3448 2052 dllhost.exe cmd.exe PID 1284 wrote to memory of 4092 1284 cmd.exe schtasks.exe PID 1284 wrote to memory of 4092 1284 cmd.exe schtasks.exe PID 1284 wrote to memory of 4092 1284 cmd.exe schtasks.exe PID 3836 wrote to memory of 1860 3836 cmd.exe schtasks.exe PID 3836 wrote to memory of 1860 3836 cmd.exe schtasks.exe PID 3836 wrote to memory of 1860 3836 cmd.exe schtasks.exe PID 3188 wrote to memory of 3860 3188 cmd.exe schtasks.exe PID 3188 wrote to memory of 3860 3188 cmd.exe schtasks.exe PID 3188 wrote to memory of 3860 3188 cmd.exe schtasks.exe PID 3024 wrote to memory of 740 3024 cmd.exe schtasks.exe PID 3024 wrote to memory of 740 3024 cmd.exe schtasks.exe PID 3024 wrote to memory of 740 3024 cmd.exe schtasks.exe PID 3560 wrote to memory of 2172 3560 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe"C:\Users\Admin\AppData\Local\Temp\932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk296" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk296" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3751" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3751" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5381" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5381" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1732" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
80KB
MD50426f4269f3de8ffe4f85df9e8454b4b
SHA16fa3f292df8c849d10a21140f48d9d64d27870fe
SHA256ee0a13f5d66a499fc53678ba0e4f55f769ecb8a883d90f6025cd62c7f4ddf0ad
SHA512566b6711569011ac26294ff00ce8c06667b0dd387a89ef5e49847138ad5a25144f13a1f58bac763bc3d3d454f3ba068494e08b702f5d3e4005a5cb1feab54d02
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
80KB
MD50426f4269f3de8ffe4f85df9e8454b4b
SHA16fa3f292df8c849d10a21140f48d9d64d27870fe
SHA256ee0a13f5d66a499fc53678ba0e4f55f769ecb8a883d90f6025cd62c7f4ddf0ad
SHA512566b6711569011ac26294ff00ce8c06667b0dd387a89ef5e49847138ad5a25144f13a1f58bac763bc3d3d454f3ba068494e08b702f5d3e4005a5cb1feab54d02
-
C:\ProgramData\HostData\logs.uceFilesize
503B
MD58b078b9c907544907733f5f47030bcb7
SHA10c45a6f025053768758df477c4812c5933a8e366
SHA256d8c7f0f440d786c3ebc13a59eb5e99d31e34c89cb47603f4f790da54707c34df
SHA5123ab98331ab7913bdafac180a3976b9c8bb24c68c1aeb109f5c18939d5725f4c38d81565551f9b2dba297e16d71c7ece671cda2ca3d101ec20d957cc7a160db41
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD54cf2fa7f35915987abb55863f8633272
SHA1cee09a17131f45e6144cdaee92959d57d8f2744d
SHA256ef361eb70b943db2ce5ddc9501c8b923c0712c9f34e258786074a81a3236aa9c
SHA512a87d8d89825cf3c484731bb7849f339e1ba226304164a6a024443db2329ea1b0a0cb9e943c3a8a62dbf23062113df758e05224f4563c772e623c97496da446aa
-
memory/504-884-0x0000000000000000-mapping.dmp
-
memory/716-690-0x0000000000000000-mapping.dmp
-
memory/740-795-0x0000000000000000-mapping.dmp
-
memory/744-181-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/744-180-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/744-179-0x0000000000000000-mapping.dmp
-
memory/744-186-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/744-185-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/744-184-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/744-183-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/744-182-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/1284-681-0x0000000000000000-mapping.dmp
-
memory/1292-686-0x0000000000000000-mapping.dmp
-
memory/1424-537-0x0000000000000000-mapping.dmp
-
memory/1644-891-0x0000000000000000-mapping.dmp
-
memory/1860-775-0x0000000000000000-mapping.dmp
-
memory/1888-178-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/1888-173-0x0000000000000000-mapping.dmp
-
memory/1888-177-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/1888-176-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/1888-175-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/1888-174-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/1896-916-0x0000000000000000-mapping.dmp
-
memory/2004-720-0x0000000000000000-mapping.dmp
-
memory/2052-652-0x0000000004B00000-0x0000000004B06000-memory.dmpFilesize
24KB
-
memory/2052-590-0x0000000000000000-mapping.dmp
-
memory/2052-640-0x0000000000370000-0x000000000038A000-memory.dmpFilesize
104KB
-
memory/2112-809-0x0000000000000000-mapping.dmp
-
memory/2148-811-0x0000000000000000-mapping.dmp
-
memory/2152-929-0x0000000000000000-mapping.dmp
-
memory/2172-804-0x0000000000000000-mapping.dmp
-
memory/2268-700-0x0000000000000000-mapping.dmp
-
memory/2360-923-0x0000000000000000-mapping.dmp
-
memory/2780-725-0x0000000000000000-mapping.dmp
-
memory/3024-695-0x0000000000000000-mapping.dmp
-
memory/3068-878-0x0000000000000000-mapping.dmp
-
memory/3188-710-0x0000000000000000-mapping.dmp
-
memory/3248-263-0x00000000080D0000-0x0000000008420000-memory.dmpFilesize
3.3MB
-
memory/3248-298-0x0000000009670000-0x000000000968E000-memory.dmpFilesize
120KB
-
memory/3248-188-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3248-223-0x0000000005000000-0x0000000005036000-memory.dmpFilesize
216KB
-
memory/3248-228-0x0000000007710000-0x0000000007D38000-memory.dmpFilesize
6.2MB
-
memory/3248-250-0x0000000007D40000-0x0000000007D62000-memory.dmpFilesize
136KB
-
memory/3248-705-0x0000000000000000-mapping.dmp
-
memory/3248-519-0x0000000009B40000-0x0000000009B48000-memory.dmpFilesize
32KB
-
memory/3248-514-0x0000000009B50000-0x0000000009B6A000-memory.dmpFilesize
104KB
-
memory/3248-311-0x0000000009BD0000-0x0000000009C64000-memory.dmpFilesize
592KB
-
memory/3248-307-0x00000000096D0000-0x0000000009775000-memory.dmpFilesize
660KB
-
memory/3248-187-0x0000000000000000-mapping.dmp
-
memory/3248-297-0x0000000009690000-0x00000000096C3000-memory.dmpFilesize
204KB
-
memory/3248-284-0x0000000008830000-0x00000000088A6000-memory.dmpFilesize
472KB
-
memory/3248-276-0x00000000087E0000-0x000000000882B000-memory.dmpFilesize
300KB
-
memory/3248-275-0x0000000007F90000-0x0000000007FAC000-memory.dmpFilesize
112KB
-
memory/3248-256-0x0000000007FC0000-0x0000000008026000-memory.dmpFilesize
408KB
-
memory/3424-897-0x0000000000000000-mapping.dmp
-
memory/3448-732-0x0000000000000000-mapping.dmp
-
memory/3560-715-0x0000000000000000-mapping.dmp
-
memory/3756-903-0x0000000000000000-mapping.dmp
-
memory/3768-139-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-127-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-137-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-136-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-135-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-134-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-133-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-160-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-140-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-141-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-142-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-143-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-144-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-147-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-145-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-146-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-172-0x0000000005460000-0x00000000054C6000-memory.dmpFilesize
408KB
-
memory/3768-171-0x00000000053D0000-0x00000000053DA000-memory.dmpFilesize
40KB
-
memory/3768-170-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-169-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-168-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-167-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-166-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-132-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-131-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-159-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-130-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-129-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-128-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-158-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-117-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-148-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-138-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-126-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-125-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-165-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-157-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-156-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-155-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/3768-124-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-164-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-154-0x0000000005750000-0x0000000005C4E000-memory.dmpFilesize
5.0MB
-
memory/3768-163-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-123-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-149-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-118-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-122-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-153-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-152-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-151-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-121-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-150-0x0000000000AF0000-0x0000000000AFA000-memory.dmpFilesize
40KB
-
memory/3768-120-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-119-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-162-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-161-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3804-935-0x0000000000000000-mapping.dmp
-
memory/3836-683-0x0000000000000000-mapping.dmp
-
memory/3860-783-0x0000000000000000-mapping.dmp
-
memory/4060-910-0x0000000000000000-mapping.dmp
-
memory/4092-774-0x0000000000000000-mapping.dmp