Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-09-2022 03:56

General

  • Target

    6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe

  • Size

    712KB

  • MD5

    ea9fa66ca76fd68b6ba877fef8a017c1

  • SHA1

    13d2f1af4ca15051b44b6bca4438ca3350d124b2

  • SHA256

    6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca

  • SHA512

    5df3d21d09a68429aa628e0d4f75d6e5f42ef0ecaaca242428a0353349b88869ad1494f14902351400ef0b6bd68cbe3c87b7de81adc64f75211c4cbaef52f9e5

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe
    "C:\Users\Admin\AppData\Local\Temp\6056760abcd05e865e70c3a65ea980d55ef9c601150eb02898154afe11a624ca.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:3404
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4944
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3724
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4428
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4644
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4392
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4556
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:2820
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4584
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4000
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:2076
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9306" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4776
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9306" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4352
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3780
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:2828
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 408
                      5⤵
                      • Program crash
                      PID:756
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:508
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8460" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1032
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8460" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:4456
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7809" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:2196
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7809" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:4944
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2913" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:1852
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                        3⤵
                          PID:2224
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            4⤵
                              PID:1852
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                            3⤵
                              PID:3532
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:3276
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                3⤵
                                  PID:3836
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    4⤵
                                      PID:4812

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                880KB

                                MD5

                                bc1e43e5ab48ce5f339e46df2576c55b

                                SHA1

                                95d7fd5967ee2b373069c494c969f6154a0a83c2

                                SHA256

                                cb2e6a89ea7fd8ed92119fdfad644ba2d93ce8823d14cce06ff25c843ecefa75

                                SHA512

                                a565ec61a733fea1ca52a0483e905262af03506a5e7bc36a7b96105b7796153753b3cd88ba516395afe7eca31c7784d0636acf80dc8ec476f0803c963ea60d67

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                880KB

                                MD5

                                bc1e43e5ab48ce5f339e46df2576c55b

                                SHA1

                                95d7fd5967ee2b373069c494c969f6154a0a83c2

                                SHA256

                                cb2e6a89ea7fd8ed92119fdfad644ba2d93ce8823d14cce06ff25c843ecefa75

                                SHA512

                                a565ec61a733fea1ca52a0483e905262af03506a5e7bc36a7b96105b7796153753b3cd88ba516395afe7eca31c7784d0636acf80dc8ec476f0803c963ea60d67

                              • C:\ProgramData\HostData\logs.uce

                                Filesize

                                497B

                                MD5

                                13fda2ab01b83a5130842a5bab3892d3

                                SHA1

                                6e18e4b467cde054a63a95d4dfc030f156ecd215

                                SHA256

                                76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                SHA512

                                c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                Filesize

                                2KB

                                MD5

                                1c19c16e21c97ed42d5beabc93391fc5

                                SHA1

                                8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                SHA256

                                1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                SHA512

                                7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                18KB

                                MD5

                                2e42a7a4091a5990b0fba82e1aa35692

                                SHA1

                                3c2d6898502e8fa11efd7bcc075651600d7e7587

                                SHA256

                                8f97d3cb268a208dd22a93d5f50c883942df6555cc6d999f0b69b7167ab12015

                                SHA512

                                63fb0ba742da6832dfa6d4069ef1d3662f36d21bc872784c0ed360d6bf94899f21a76b3a1b176ed4d16149ff7d02c311b68320eed627a6a2f3d89129cbc68df0

                              • memory/508-754-0x0000000000000000-mapping.dmp

                              • memory/1032-772-0x0000000000000000-mapping.dmp

                              • memory/1852-1113-0x0000000000000000-mapping.dmp

                              • memory/1852-778-0x0000000000000000-mapping.dmp

                              • memory/2008-178-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2008-176-0x0000000000000000-mapping.dmp

                              • memory/2008-177-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2008-179-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2008-180-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2008-181-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2076-826-0x0000000000000000-mapping.dmp

                              • memory/2196-785-0x0000000000000000-mapping.dmp

                              • memory/2224-1107-0x0000000000000000-mapping.dmp

                              • memory/2820-816-0x0000000000000000-mapping.dmp

                              • memory/2828-818-0x0000000000000000-mapping.dmp

                              • memory/3276-1137-0x0000000000000000-mapping.dmp

                              • memory/3404-187-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3404-182-0x0000000000000000-mapping.dmp

                              • memory/3404-184-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3404-186-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3404-183-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3404-188-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3404-189-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3404-185-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/3532-1131-0x0000000000000000-mapping.dmp

                              • memory/3724-528-0x0000000000000000-mapping.dmp

                              • memory/3780-760-0x0000000000000000-mapping.dmp

                              • memory/3836-1160-0x0000000000000000-mapping.dmp

                              • memory/4000-748-0x0000000000000000-mapping.dmp

                              • memory/4168-616-0x0000000000000000-mapping.dmp

                              • memory/4168-688-0x0000000000A50000-0x0000000000B00000-memory.dmp

                                Filesize

                                704KB

                              • memory/4352-834-0x0000000000000000-mapping.dmp

                              • memory/4392-733-0x0000000000000000-mapping.dmp

                              • memory/4428-727-0x0000000000000000-mapping.dmp

                              • memory/4456-820-0x0000000000000000-mapping.dmp

                              • memory/4528-172-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-124-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-162-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-163-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-164-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-165-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-166-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-167-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-168-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-169-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-170-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-171-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-160-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-173-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-174-0x00000000053D0000-0x00000000053DA000-memory.dmp

                                Filesize

                                40KB

                              • memory/4528-175-0x0000000005470000-0x00000000054D6000-memory.dmp

                                Filesize

                                408KB

                              • memory/4528-159-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-158-0x0000000005270000-0x0000000005302000-memory.dmp

                                Filesize

                                584KB

                              • memory/4528-120-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-157-0x0000000005690000-0x0000000005B8E000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/4528-156-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-155-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-154-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-130-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-153-0x0000000000990000-0x0000000000A38000-memory.dmp

                                Filesize

                                672KB

                              • memory/4528-131-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-152-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-151-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-150-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-149-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-132-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-133-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-121-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-134-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-122-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-135-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-136-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-137-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-138-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-139-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-140-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-123-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-148-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-141-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-161-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-125-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-147-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-129-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-128-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-146-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-127-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-126-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-145-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-144-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-142-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4528-143-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4556-737-0x0000000000000000-mapping.dmp

                              • memory/4584-742-0x0000000000000000-mapping.dmp

                              • memory/4644-729-0x0000000000000000-mapping.dmp

                              • memory/4776-766-0x0000000000000000-mapping.dmp

                              • memory/4812-1166-0x0000000000000000-mapping.dmp

                              • memory/4944-271-0x0000000008000000-0x000000000804B000-memory.dmp

                                Filesize

                                300KB

                              • memory/4944-844-0x0000000000000000-mapping.dmp

                              • memory/4944-302-0x0000000009670000-0x0000000009704000-memory.dmp

                                Filesize

                                592KB

                              • memory/4944-288-0x0000000009390000-0x00000000093C3000-memory.dmp

                                Filesize

                                204KB

                              • memory/4944-275-0x0000000008280000-0x00000000082F6000-memory.dmp

                                Filesize

                                472KB

                              • memory/4944-505-0x0000000009620000-0x000000000963A000-memory.dmp

                                Filesize

                                104KB

                              • memory/4944-270-0x0000000007A10000-0x0000000007A2C000-memory.dmp

                                Filesize

                                112KB

                              • memory/4944-258-0x0000000007C30000-0x0000000007F80000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/4944-254-0x0000000007290000-0x00000000072F6000-memory.dmp

                                Filesize

                                408KB

                              • memory/4944-289-0x0000000009370000-0x000000000938E000-memory.dmp

                                Filesize

                                120KB

                              • memory/4944-249-0x00000000071F0000-0x0000000007212000-memory.dmp

                                Filesize

                                136KB

                              • memory/4944-231-0x00000000073E0000-0x0000000007A08000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/4944-226-0x0000000004B00000-0x0000000004B36000-memory.dmp

                                Filesize

                                216KB

                              • memory/4944-191-0x0000000077530000-0x00000000776BE000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4944-190-0x0000000000000000-mapping.dmp

                              • memory/4944-298-0x00000000093D0000-0x0000000009475000-memory.dmp

                                Filesize

                                660KB

                              • memory/4944-510-0x0000000009610000-0x0000000009618000-memory.dmp

                                Filesize

                                32KB