Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe
Resource
win10-20220718-en
General
-
Target
beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe
-
Size
685KB
-
MD5
c726f7a28ffba569cae59b734841038b
-
SHA1
bd0f314327d3687e773730fc5141c2c9117d48ab
-
SHA256
beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452
-
SHA512
7a703efd3cf87d53eca3f75db2f16f08e8034be6d5a01476b85df23fa02059134862f97cf7d34817ba4c0091d426f9e8637e11f4949311afdaa58fb46a9b99f3
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
dllhost.exepid process 340 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1704 schtasks.exe 3844 schtasks.exe 1060 schtasks.exe 3140 schtasks.exe 1124 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedllhost.exepid process 3972 powershell.exe 3972 powershell.exe 3972 powershell.exe 796 powershell.exe 796 powershell.exe 796 powershell.exe 3344 powershell.exe 3344 powershell.exe 3344 powershell.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe 340 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exebeec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exepowershell.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 3972 powershell.exe Token: SeDebugPrivilege 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe Token: SeDebugPrivilege 796 powershell.exe Token: SeDebugPrivilege 3344 powershell.exe Token: SeDebugPrivilege 340 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.execmd.exedllhost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 512 wrote to memory of 1328 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe cmd.exe PID 512 wrote to memory of 1328 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe cmd.exe PID 512 wrote to memory of 1328 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe cmd.exe PID 1328 wrote to memory of 1320 1328 cmd.exe chcp.com PID 1328 wrote to memory of 1320 1328 cmd.exe chcp.com PID 1328 wrote to memory of 1320 1328 cmd.exe chcp.com PID 1328 wrote to memory of 3972 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 3972 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 3972 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 796 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 796 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 796 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 3344 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 3344 1328 cmd.exe powershell.exe PID 1328 wrote to memory of 3344 1328 cmd.exe powershell.exe PID 512 wrote to memory of 340 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe dllhost.exe PID 512 wrote to memory of 340 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe dllhost.exe PID 512 wrote to memory of 340 512 beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe dllhost.exe PID 340 wrote to memory of 2520 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2520 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2520 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3596 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3596 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3596 340 dllhost.exe cmd.exe PID 340 wrote to memory of 352 340 dllhost.exe cmd.exe PID 340 wrote to memory of 352 340 dllhost.exe cmd.exe PID 340 wrote to memory of 352 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2984 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2984 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2984 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3852 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3852 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3852 340 dllhost.exe cmd.exe PID 340 wrote to memory of 576 340 dllhost.exe cmd.exe PID 340 wrote to memory of 576 340 dllhost.exe cmd.exe PID 340 wrote to memory of 576 340 dllhost.exe cmd.exe PID 340 wrote to memory of 1824 340 dllhost.exe cmd.exe PID 340 wrote to memory of 1824 340 dllhost.exe cmd.exe PID 340 wrote to memory of 1824 340 dllhost.exe cmd.exe PID 340 wrote to memory of 828 340 dllhost.exe cmd.exe PID 340 wrote to memory of 828 340 dllhost.exe cmd.exe PID 340 wrote to memory of 828 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2468 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2468 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2468 340 dllhost.exe cmd.exe PID 340 wrote to memory of 1872 340 dllhost.exe cmd.exe PID 340 wrote to memory of 1872 340 dllhost.exe cmd.exe PID 340 wrote to memory of 1872 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3980 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3980 340 dllhost.exe cmd.exe PID 340 wrote to memory of 3980 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2828 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2828 340 dllhost.exe cmd.exe PID 340 wrote to memory of 2828 340 dllhost.exe cmd.exe PID 3596 wrote to memory of 3844 3596 cmd.exe schtasks.exe PID 3596 wrote to memory of 3844 3596 cmd.exe schtasks.exe PID 3596 wrote to memory of 3844 3596 cmd.exe schtasks.exe PID 2984 wrote to memory of 1060 2984 cmd.exe schtasks.exe PID 2984 wrote to memory of 1060 2984 cmd.exe schtasks.exe PID 2984 wrote to memory of 1060 2984 cmd.exe schtasks.exe PID 1824 wrote to memory of 1124 1824 cmd.exe schtasks.exe PID 1824 wrote to memory of 1124 1824 cmd.exe schtasks.exe PID 1824 wrote to memory of 1124 1824 cmd.exe schtasks.exe PID 828 wrote to memory of 3140 828 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe"C:\Users\Admin\AppData\Local\Temp\beec95f3bdb5ee9eaa09d9fd79056c1cf9370bc30122adf53bb12373fbadb452.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:1320
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344 -
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2520
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3844 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:352
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:3852
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:1124 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3140 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9740" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:3980
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9740" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:1704 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6247" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1872
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7884" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2468
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:576
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1321" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2828
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:1508
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:2180
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:648
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:576
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:2984
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:3936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
772KB
MD5e960b16dc0a07d6c2924d59e70c6678c
SHA1edd31e3920269a56a863f8e84b2983d26d0b0ac0
SHA256ba344ccfeb76d0c688f81fe29d9732ae695dd9b94b7bafef441806b9b56b85ff
SHA5129ab3f9dd40fc561d62d08f9769098363723fd908525843043b0fccb86d918d419cd526d8cb7053ef4dc26aaebc193a309a240f73ee794ebdccd5883ce2a93e8c
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
772KB
MD5e960b16dc0a07d6c2924d59e70c6678c
SHA1edd31e3920269a56a863f8e84b2983d26d0b0ac0
SHA256ba344ccfeb76d0c688f81fe29d9732ae695dd9b94b7bafef441806b9b56b85ff
SHA5129ab3f9dd40fc561d62d08f9769098363723fd908525843043b0fccb86d918d419cd526d8cb7053ef4dc26aaebc193a309a240f73ee794ebdccd5883ce2a93e8c
-
C:\ProgramData\HostData\logs.uceFilesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ca1bda2235cdb15950e58e2df89baff9
SHA1029c0922fc94b20cb7a4727ece400a45f38cd09c
SHA256d58197323260de692114a4b48990472053c076d28122688541059ade47d5d48c
SHA51206cfaa9880547219605327beafa8cb35be7b2e14acac6e6a4161f81d71a6f102b1d962940190e7adbfaba575def8afba02cdfd44bd404151825d64db9254b635
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5733556760d63a75017f841d3744c17da
SHA11ddf4b5e1d2d0be8f33fb28af5c1d34956bd8542
SHA256c66496a3abc4f11fa72d5d64455cf318b240fe4421682a03dc5bd6e50cc2cfb5
SHA5127bce2d6ba9ae978b487769f2ba2b02d6b9eba0e3c3baa53c1e80da8effe5031d2133e804e3cb76e8b738ee27e6de9e1aae2d7af6822047fb52173f3d67f7e02b
-
memory/340-959-0x0000000000600000-0x00000000006B0000-memory.dmpFilesize
704KB
-
memory/340-906-0x0000000000000000-mapping.dmp
-
memory/352-1009-0x0000000000000000-mapping.dmp
-
memory/512-146-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-140-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-128-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-129-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-130-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-131-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-132-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-133-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-134-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-135-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-136-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-137-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-118-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-139-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-119-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-141-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-142-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-143-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-144-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-145-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-117-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-147-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-148-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-149-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-150-0x0000000000EC0000-0x0000000000F68000-memory.dmpFilesize
672KB
-
memory/512-151-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-152-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-153-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-154-0x0000000005C40000-0x000000000613E000-memory.dmpFilesize
5.0MB
-
memory/512-155-0x00000000057E0000-0x0000000005872000-memory.dmpFilesize
584KB
-
memory/512-156-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-157-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-158-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-159-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-160-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-161-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-162-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-163-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-164-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-165-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-166-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-167-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-168-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-169-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-170-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-171-0x00000000057A0000-0x00000000057AA000-memory.dmpFilesize
40KB
-
memory/512-172-0x00000000059D0000-0x0000000005A36000-memory.dmpFilesize
408KB
-
memory/512-120-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-121-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-122-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-123-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-124-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-125-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-126-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-138-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-127-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/576-1451-0x0000000000000000-mapping.dmp
-
memory/576-1025-0x0000000000000000-mapping.dmp
-
memory/648-1445-0x0000000000000000-mapping.dmp
-
memory/796-525-0x0000000000000000-mapping.dmp
-
memory/828-1037-0x0000000000000000-mapping.dmp
-
memory/1060-1121-0x0000000000000000-mapping.dmp
-
memory/1124-1127-0x0000000000000000-mapping.dmp
-
memory/1320-182-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1320-183-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1320-181-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1320-180-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1320-186-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1320-184-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1320-179-0x0000000000000000-mapping.dmp
-
memory/1320-185-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1328-173-0x0000000000000000-mapping.dmp
-
memory/1328-178-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1328-176-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1328-174-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1328-177-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1328-175-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/1508-1419-0x0000000000000000-mapping.dmp
-
memory/1704-1148-0x0000000000000000-mapping.dmp
-
memory/1824-1031-0x0000000000000000-mapping.dmp
-
memory/1872-1049-0x0000000000000000-mapping.dmp
-
memory/2180-1425-0x0000000000000000-mapping.dmp
-
memory/2468-1043-0x0000000000000000-mapping.dmp
-
memory/2520-1004-0x0000000000000000-mapping.dmp
-
memory/2828-1061-0x0000000000000000-mapping.dmp
-
memory/2984-1014-0x0000000000000000-mapping.dmp
-
memory/2984-1484-0x0000000000000000-mapping.dmp
-
memory/3140-1129-0x0000000000000000-mapping.dmp
-
memory/3344-836-0x0000000000000000-mapping.dmp
-
memory/3596-1005-0x0000000000000000-mapping.dmp
-
memory/3844-1107-0x0000000000000000-mapping.dmp
-
memory/3852-1019-0x0000000000000000-mapping.dmp
-
memory/3936-1490-0x0000000000000000-mapping.dmp
-
memory/3972-245-0x0000000007460000-0x0000000007482000-memory.dmpFilesize
136KB
-
memory/3972-286-0x0000000008DA0000-0x0000000008DBE000-memory.dmpFilesize
120KB
-
memory/3972-255-0x0000000007670000-0x000000000768C000-memory.dmpFilesize
112KB
-
memory/3972-502-0x00000000090B0000-0x00000000090CA000-memory.dmpFilesize
104KB
-
memory/3972-249-0x0000000007830000-0x0000000007B80000-memory.dmpFilesize
3.3MB
-
memory/3972-285-0x0000000009000000-0x0000000009033000-memory.dmpFilesize
204KB
-
memory/3972-269-0x0000000007EC0000-0x0000000007F36000-memory.dmpFilesize
472KB
-
memory/3972-248-0x0000000007500000-0x0000000007566000-memory.dmpFilesize
408KB
-
memory/3972-295-0x00000000091D0000-0x0000000009275000-memory.dmpFilesize
660KB
-
memory/3972-299-0x0000000009320000-0x00000000093B4000-memory.dmpFilesize
592KB
-
memory/3972-257-0x0000000008100000-0x000000000814B000-memory.dmpFilesize
300KB
-
memory/3972-507-0x00000000090A0000-0x00000000090A8000-memory.dmpFilesize
32KB
-
memory/3972-228-0x0000000006E00000-0x0000000007428000-memory.dmpFilesize
6.2MB
-
memory/3972-223-0x0000000006740000-0x0000000006776000-memory.dmpFilesize
216KB
-
memory/3972-188-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/3972-187-0x0000000000000000-mapping.dmp
-
memory/3980-1055-0x0000000000000000-mapping.dmp