Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe
Resource
win10-20220812-en
General
-
Target
4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe
-
Size
723KB
-
MD5
58aabd288f81d0f7533fd6a3bb875faf
-
SHA1
acf1bdfb0c96d8ee195fd4958ea9e53d25bce56f
-
SHA256
4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d
-
SHA512
45e7e416b1716429a041079240aa7dadc2fc0bafd5989bf65c916c44757697d2dac58d63cf796ab55e263fe35c09e4d19460e30525c231168e67795cba5f3235
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
dllhost.exepid process 3400 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 860 schtasks.exe 1560 schtasks.exe 2920 schtasks.exe 3628 schtasks.exe 1928 schtasks.exe 3848 schtasks.exe 1440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exedllhost.exepid process 2104 powershell.exe 2104 powershell.exe 2104 powershell.exe 1680 powershell.exe 1680 powershell.exe 1680 powershell.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe 3400 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exe4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 2104 powershell.exe Token: SeDebugPrivilege 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe Token: SeDebugPrivilege 1680 powershell.exe Token: SeDebugPrivilege 3400 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.execmd.exedllhost.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2124 wrote to memory of 4592 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe cmd.exe PID 2124 wrote to memory of 4592 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe cmd.exe PID 2124 wrote to memory of 4592 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe cmd.exe PID 4592 wrote to memory of 5100 4592 cmd.exe chcp.com PID 4592 wrote to memory of 5100 4592 cmd.exe chcp.com PID 4592 wrote to memory of 5100 4592 cmd.exe chcp.com PID 4592 wrote to memory of 2104 4592 cmd.exe powershell.exe PID 4592 wrote to memory of 2104 4592 cmd.exe powershell.exe PID 4592 wrote to memory of 2104 4592 cmd.exe powershell.exe PID 4592 wrote to memory of 1680 4592 cmd.exe powershell.exe PID 4592 wrote to memory of 1680 4592 cmd.exe powershell.exe PID 4592 wrote to memory of 1680 4592 cmd.exe powershell.exe PID 2124 wrote to memory of 3400 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe dllhost.exe PID 2124 wrote to memory of 3400 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe dllhost.exe PID 2124 wrote to memory of 3400 2124 4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe dllhost.exe PID 3400 wrote to memory of 5108 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 5108 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 5108 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4972 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4972 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4972 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4712 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4712 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4712 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 3584 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 3584 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 3584 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 3596 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 3596 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 3596 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4740 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4740 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4740 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4696 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4696 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4696 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4604 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4604 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4604 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4664 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4664 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 4664 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 324 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 324 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 324 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 680 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 680 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 680 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 412 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 412 3400 dllhost.exe cmd.exe PID 3400 wrote to memory of 412 3400 dllhost.exe cmd.exe PID 4712 wrote to memory of 860 4712 cmd.exe schtasks.exe PID 4712 wrote to memory of 860 4712 cmd.exe schtasks.exe PID 4712 wrote to memory of 860 4712 cmd.exe schtasks.exe PID 3584 wrote to memory of 1440 3584 cmd.exe schtasks.exe PID 3584 wrote to memory of 1440 3584 cmd.exe schtasks.exe PID 3584 wrote to memory of 1440 3584 cmd.exe schtasks.exe PID 4604 wrote to memory of 2920 4604 cmd.exe schtasks.exe PID 4604 wrote to memory of 2920 4604 cmd.exe schtasks.exe PID 4604 wrote to memory of 2920 4604 cmd.exe schtasks.exe PID 4972 wrote to memory of 3848 4972 cmd.exe schtasks.exe PID 4972 wrote to memory of 3848 4972 cmd.exe schtasks.exe PID 4972 wrote to memory of 3848 4972 cmd.exe schtasks.exe PID 3596 wrote to memory of 1928 3596 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe"C:\Users\Admin\AppData\Local\Temp\4efb809e7243747c92444908341002a2b20d7234be13974b545590eaee58ec0d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4888" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4888" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6078" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6310" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7474" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7474" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
918KB
MD5e0bb98a1f2b9347e2484c91c5c01d015
SHA162170b16d972b6e64baf8038537de5ad7b390a06
SHA2566cde87211944302aedbb1fce11203069d175a383a50274bfc0961786671e2922
SHA51258903c61864dc254fad9eb12a581bc9f4acac7dc7b7a9b7737bdf38f4542d4100a0c1ead55f7fab9720ab3cf369b4594d05cc8e87c1c039a3f4e5b0f8f56e6b1
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
918KB
MD5e0bb98a1f2b9347e2484c91c5c01d015
SHA162170b16d972b6e64baf8038537de5ad7b390a06
SHA2566cde87211944302aedbb1fce11203069d175a383a50274bfc0961786671e2922
SHA51258903c61864dc254fad9eb12a581bc9f4acac7dc7b7a9b7737bdf38f4542d4100a0c1ead55f7fab9720ab3cf369b4594d05cc8e87c1c039a3f4e5b0f8f56e6b1
-
C:\ProgramData\HostData\logs.uceFilesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5b8c5994d070ea8e6becbc2bc6a7f5c96
SHA1a826988dbf8f0be6cc0f8a894e16a3b4a375acf5
SHA256daf34ffaabe57984fe1f34c66568abfeb79426167b59d7d09c3404399d3a177a
SHA512ed5d4a69a340660e0b088281f74ba376653061b99cd2a623035d428c5ec1edc205d9bf41234005d78d1f2212ed8a8cbbc6ec7c530ed4d2b436a6624c93d1528d
-
memory/324-772-0x0000000000000000-mapping.dmp
-
memory/412-784-0x0000000000000000-mapping.dmp
-
memory/680-778-0x0000000000000000-mapping.dmp
-
memory/860-815-0x0000000000000000-mapping.dmp
-
memory/900-1120-0x0000000000000000-mapping.dmp
-
memory/1440-816-0x0000000000000000-mapping.dmp
-
memory/1504-1126-0x0000000000000000-mapping.dmp
-
memory/1560-850-0x0000000000000000-mapping.dmp
-
memory/1680-528-0x0000000000000000-mapping.dmp
-
memory/1828-1147-0x0000000000000000-mapping.dmp
-
memory/1928-819-0x0000000000000000-mapping.dmp
-
memory/2104-271-0x00000000080E0000-0x000000000812B000-memory.dmpFilesize
300KB
-
memory/2104-288-0x0000000009470000-0x00000000094A3000-memory.dmpFilesize
204KB
-
memory/2104-505-0x0000000008440000-0x000000000845A000-memory.dmpFilesize
104KB
-
memory/2104-302-0x00000000097C0000-0x0000000009854000-memory.dmpFilesize
592KB
-
memory/2104-190-0x0000000000000000-mapping.dmp
-
memory/2104-289-0x0000000009450000-0x000000000946E000-memory.dmpFilesize
120KB
-
memory/2104-510-0x0000000008430000-0x0000000008438000-memory.dmpFilesize
32KB
-
memory/2104-275-0x0000000008360000-0x00000000083D6000-memory.dmpFilesize
472KB
-
memory/2104-298-0x00000000094B0000-0x0000000009555000-memory.dmpFilesize
660KB
-
memory/2104-270-0x0000000007A70000-0x0000000007A8C000-memory.dmpFilesize
112KB
-
memory/2104-265-0x0000000007D50000-0x00000000080A0000-memory.dmpFilesize
3.3MB
-
memory/2104-257-0x0000000007B00000-0x0000000007B66000-memory.dmpFilesize
408KB
-
memory/2104-256-0x0000000007920000-0x0000000007942000-memory.dmpFilesize
136KB
-
memory/2104-231-0x0000000007280000-0x00000000078A8000-memory.dmpFilesize
6.2MB
-
memory/2104-226-0x0000000006BC0000-0x0000000006BF6000-memory.dmpFilesize
216KB
-
memory/2104-191-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-149-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-147-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-154-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-155-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-156-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-157-0x00000000051D0000-0x00000000056CE000-memory.dmpFilesize
5.0MB
-
memory/2124-158-0x0000000004BC0000-0x0000000004C52000-memory.dmpFilesize
584KB
-
memory/2124-159-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-160-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-161-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-162-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-163-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-164-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-165-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-166-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-167-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-168-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-169-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-170-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-171-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-172-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-173-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-174-0x0000000004C60000-0x0000000004C6A000-memory.dmpFilesize
40KB
-
memory/2124-175-0x0000000004E40000-0x0000000004EA6000-memory.dmpFilesize
408KB
-
memory/2124-121-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-122-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-123-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-124-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-125-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-126-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-127-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-128-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-129-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-131-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-130-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-133-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-132-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-134-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-152-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-151-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-150-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-120-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-148-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-153-0x00000000002E0000-0x0000000000388000-memory.dmpFilesize
672KB
-
memory/2124-146-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-145-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-144-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-143-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-142-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-141-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-140-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-139-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-138-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-137-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-136-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2124-135-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2920-817-0x0000000000000000-mapping.dmp
-
memory/3400-596-0x0000000000000000-mapping.dmp
-
memory/3400-685-0x0000000000AB0000-0x0000000000B60000-memory.dmpFilesize
704KB
-
memory/3584-737-0x0000000000000000-mapping.dmp
-
memory/3596-742-0x0000000000000000-mapping.dmp
-
memory/3628-826-0x0000000000000000-mapping.dmp
-
memory/3760-1153-0x0000000000000000-mapping.dmp
-
memory/3848-818-0x0000000000000000-mapping.dmp
-
memory/4592-176-0x0000000000000000-mapping.dmp
-
memory/4592-179-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/4592-180-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/4592-178-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/4592-181-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/4592-177-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/4604-759-0x0000000000000000-mapping.dmp
-
memory/4664-765-0x0000000000000000-mapping.dmp
-
memory/4696-753-0x0000000000000000-mapping.dmp
-
memory/4712-733-0x0000000000000000-mapping.dmp
-
memory/4740-748-0x0000000000000000-mapping.dmp
-
memory/4972-730-0x0000000000000000-mapping.dmp
-
memory/5100-183-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5100-182-0x0000000000000000-mapping.dmp
-
memory/5100-186-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5100-185-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5100-184-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5100-189-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5100-187-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5100-188-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/5108-728-0x0000000000000000-mapping.dmp