Analysis
-
max time kernel
300s -
max time network
197s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-05-2022 10:15
Static task
static1
Behavioral task
behavioral1
Sample
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe
Resource
win10-20220414-en
General
-
Target
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe
-
Size
16KB
-
MD5
23c8b23571c065c1d8c65beb2899cc42
-
SHA1
fd7f51575ccaeba2cd6cb0d2195e2be966c0fecf
-
SHA256
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2
-
SHA512
af1df92b60d1cff475deb7688b7a8baff26feb240a0d48a9cd73df3d1a5b9acff72d353f686de259d3bd77c0df1a7f7b269434789189a26c46a02313bdb5e64c
Malware Config
Signatures
-
CobaltStrike 1 IoCs
CobaltStrike.
Processes:
resource yara_rule behavioral2/memory/1564-308-0x0000000008FF0000-0x0000000009095000-memory.dmp cobalt_strike_tmp01925d3f -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
dllhost.exepid process 1224 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2536 schtasks.exe 796 schtasks.exe 1656 schtasks.exe 396 schtasks.exe 4032 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exedllhost.exepid process 1564 powershell.exe 1564 powershell.exe 1564 powershell.exe 3748 powershell.exe 3748 powershell.exe 3748 powershell.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe 1224 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exe932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 1564 powershell.exe Token: SeDebugPrivilege 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe Token: SeDebugPrivilege 3748 powershell.exe Token: SeDebugPrivilege 1224 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.execmd.exedllhost.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2692 wrote to memory of 976 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe cmd.exe PID 2692 wrote to memory of 976 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe cmd.exe PID 2692 wrote to memory of 976 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe cmd.exe PID 976 wrote to memory of 2100 976 cmd.exe chcp.com PID 976 wrote to memory of 2100 976 cmd.exe chcp.com PID 976 wrote to memory of 2100 976 cmd.exe chcp.com PID 976 wrote to memory of 1564 976 cmd.exe powershell.exe PID 976 wrote to memory of 1564 976 cmd.exe powershell.exe PID 976 wrote to memory of 1564 976 cmd.exe powershell.exe PID 976 wrote to memory of 3748 976 cmd.exe powershell.exe PID 976 wrote to memory of 3748 976 cmd.exe powershell.exe PID 976 wrote to memory of 3748 976 cmd.exe powershell.exe PID 2692 wrote to memory of 1224 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe dllhost.exe PID 2692 wrote to memory of 1224 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe dllhost.exe PID 2692 wrote to memory of 1224 2692 932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe dllhost.exe PID 1224 wrote to memory of 2996 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2996 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2996 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2288 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2288 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2288 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 792 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 792 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 792 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 688 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 688 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 688 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2720 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2720 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2720 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2876 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2876 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2876 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2260 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2260 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2260 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 1928 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 1928 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 1928 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 4076 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 4076 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 4076 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 3444 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 3444 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 3444 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2084 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2084 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 2084 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 1864 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 1864 1224 dllhost.exe cmd.exe PID 1224 wrote to memory of 1864 1224 dllhost.exe cmd.exe PID 2996 wrote to memory of 1656 2996 cmd.exe schtasks.exe PID 2996 wrote to memory of 1656 2996 cmd.exe schtasks.exe PID 2996 wrote to memory of 1656 2996 cmd.exe schtasks.exe PID 792 wrote to memory of 796 792 cmd.exe schtasks.exe PID 792 wrote to memory of 796 792 cmd.exe schtasks.exe PID 792 wrote to memory of 796 792 cmd.exe schtasks.exe PID 2288 wrote to memory of 2536 2288 cmd.exe schtasks.exe PID 2288 wrote to memory of 2536 2288 cmd.exe schtasks.exe PID 2288 wrote to memory of 2536 2288 cmd.exe schtasks.exe PID 2260 wrote to memory of 396 2260 cmd.exe schtasks.exe PID 2260 wrote to memory of 396 2260 cmd.exe schtasks.exe PID 2260 wrote to memory of 396 2260 cmd.exe schtasks.exe PID 1928 wrote to memory of 4032 1928 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe"C:\Users\Admin\AppData\Local\Temp\932b589a050018c47609fa544370f1382525764c3ed1df2b844ffaa05297d4e2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6872" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7440" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5837" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5771" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
80KB
MD50426f4269f3de8ffe4f85df9e8454b4b
SHA16fa3f292df8c849d10a21140f48d9d64d27870fe
SHA256ee0a13f5d66a499fc53678ba0e4f55f769ecb8a883d90f6025cd62c7f4ddf0ad
SHA512566b6711569011ac26294ff00ce8c06667b0dd387a89ef5e49847138ad5a25144f13a1f58bac763bc3d3d454f3ba068494e08b702f5d3e4005a5cb1feab54d02
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
80KB
MD50426f4269f3de8ffe4f85df9e8454b4b
SHA16fa3f292df8c849d10a21140f48d9d64d27870fe
SHA256ee0a13f5d66a499fc53678ba0e4f55f769ecb8a883d90f6025cd62c7f4ddf0ad
SHA512566b6711569011ac26294ff00ce8c06667b0dd387a89ef5e49847138ad5a25144f13a1f58bac763bc3d3d454f3ba068494e08b702f5d3e4005a5cb1feab54d02
-
C:\ProgramData\HostData\logs.uceFilesize
503B
MD58b078b9c907544907733f5f47030bcb7
SHA10c45a6f025053768758df477c4812c5933a8e366
SHA256d8c7f0f440d786c3ebc13a59eb5e99d31e34c89cb47603f4f790da54707c34df
SHA5123ab98331ab7913bdafac180a3976b9c8bb24c68c1aeb109f5c18939d5725f4c38d81565551f9b2dba297e16d71c7ece671cda2ca3d101ec20d957cc7a160db41
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD586f25d9cad9621b2b9d083bb248d86e1
SHA153267b09e853ed0c239071d8a9a59a9e8542cb67
SHA256ae123613910eb350cc59664916f635cfbdfb00e755b2be78bedde3d65f99b0ee
SHA5128ac8c1a77523108a5e246ae3e68cc6d049a191bb10a693f7f358bf6a02b446e754636536ee0325a72043e8b8424b88cc74c0a013bddb3d9ef5d88e4f81706de8
-
memory/328-1111-0x0000000000000000-mapping.dmp
-
memory/396-945-0x0000000000000000-mapping.dmp
-
memory/688-820-0x0000000000000000-mapping.dmp
-
memory/792-816-0x0000000000000000-mapping.dmp
-
memory/796-912-0x0000000000000000-mapping.dmp
-
memory/976-174-0x0000000000000000-mapping.dmp
-
memory/976-175-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/976-176-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/976-177-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/976-178-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/976-179-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1224-775-0x0000000002C00000-0x0000000002C06000-memory.dmpFilesize
24KB
-
memory/1224-759-0x00000000007F0000-0x000000000080A000-memory.dmpFilesize
104KB
-
memory/1224-699-0x0000000000000000-mapping.dmp
-
memory/1248-1117-0x0000000000000000-mapping.dmp
-
memory/1432-1072-0x0000000000000000-mapping.dmp
-
memory/1564-312-0x0000000009140000-0x00000000091D4000-memory.dmpFilesize
592KB
-
memory/1564-256-0x0000000007760000-0x0000000007AB0000-memory.dmpFilesize
3.3MB
-
memory/1564-520-0x0000000008EC0000-0x0000000008EC8000-memory.dmpFilesize
32KB
-
memory/1564-515-0x0000000008ED0000-0x0000000008EEA000-memory.dmpFilesize
104KB
-
memory/1564-188-0x0000000000000000-mapping.dmp
-
memory/1564-308-0x0000000008FF0000-0x0000000009095000-memory.dmpFilesize
660KB
-
memory/1564-299-0x0000000008BD0000-0x0000000008BEE000-memory.dmpFilesize
120KB
-
memory/1564-298-0x0000000008E30000-0x0000000008E63000-memory.dmpFilesize
204KB
-
memory/1564-276-0x0000000007CF0000-0x0000000007D66000-memory.dmpFilesize
472KB
-
memory/1564-269-0x0000000007F10000-0x0000000007F5B000-memory.dmpFilesize
300KB
-
memory/1564-268-0x0000000007510000-0x000000000752C000-memory.dmpFilesize
112KB
-
memory/1564-189-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1564-252-0x0000000007360000-0x00000000073C6000-memory.dmpFilesize
408KB
-
memory/1564-246-0x0000000006C50000-0x0000000006C72000-memory.dmpFilesize
136KB
-
memory/1564-229-0x0000000006D30000-0x0000000007358000-memory.dmpFilesize
6.2MB
-
memory/1564-224-0x0000000004520000-0x0000000004556000-memory.dmpFilesize
216KB
-
memory/1616-1065-0x0000000000000000-mapping.dmp
-
memory/1656-911-0x0000000000000000-mapping.dmp
-
memory/1864-865-0x0000000000000000-mapping.dmp
-
memory/1912-1104-0x0000000000000000-mapping.dmp
-
memory/1928-842-0x0000000000000000-mapping.dmp
-
memory/2084-859-0x0000000000000000-mapping.dmp
-
memory/2096-1046-0x0000000000000000-mapping.dmp
-
memory/2100-180-0x0000000000000000-mapping.dmp
-
memory/2100-181-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2100-187-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2100-184-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2100-185-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2100-186-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2100-183-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2100-182-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2168-1078-0x0000000000000000-mapping.dmp
-
memory/2260-836-0x0000000000000000-mapping.dmp
-
memory/2288-814-0x0000000000000000-mapping.dmp
-
memory/2536-913-0x0000000000000000-mapping.dmp
-
memory/2692-143-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-138-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-160-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-159-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-158-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-157-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-118-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-162-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-173-0x0000000004DC0000-0x0000000004E26000-memory.dmpFilesize
408KB
-
memory/2692-172-0x0000000004B60000-0x0000000004B6A000-memory.dmpFilesize
40KB
-
memory/2692-171-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-170-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-169-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-168-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-156-0x0000000004BA0000-0x0000000004C32000-memory.dmpFilesize
584KB
-
memory/2692-155-0x0000000005200000-0x00000000056FE000-memory.dmpFilesize
5.0MB
-
memory/2692-154-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-153-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-152-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-151-0x0000000000320000-0x000000000032A000-memory.dmpFilesize
40KB
-
memory/2692-150-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-149-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-148-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-147-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-146-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-145-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-144-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-163-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-142-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-141-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-119-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-139-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-140-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-161-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-137-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-136-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-135-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-134-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-120-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-121-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-164-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-133-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-167-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-132-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-131-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-122-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-130-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-129-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-166-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-123-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-165-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-128-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-127-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-126-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-124-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-125-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2720-824-0x0000000000000000-mapping.dmp
-
memory/2876-829-0x0000000000000000-mapping.dmp
-
memory/2996-812-0x0000000000000000-mapping.dmp
-
memory/3444-854-0x0000000000000000-mapping.dmp
-
memory/3652-1098-0x0000000000000000-mapping.dmp
-
memory/3720-1085-0x0000000000000000-mapping.dmp
-
memory/3748-538-0x0000000000000000-mapping.dmp
-
memory/3856-1059-0x0000000000000000-mapping.dmp
-
memory/4012-1091-0x0000000000000000-mapping.dmp
-
memory/4032-949-0x0000000000000000-mapping.dmp
-
memory/4076-848-0x0000000000000000-mapping.dmp
-
memory/4088-1052-0x0000000000000000-mapping.dmp