Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 06:48
Static task
static1
Behavioral task
behavioral1
Sample
3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe
Resource
win10-20220812-en
General
-
Target
3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe
-
Size
724KB
-
MD5
b62c0cce0d79b35581610a0b343eea9b
-
SHA1
93617a793f7e7d9a5487199d5059d905897f64aa
-
SHA256
3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c
-
SHA512
9e77ca17c63e5baa9f53d488147d79587eae29128a782620b2718a7770e01593d78848f9e10e888cf288d9aff7ded6c26f85456ff981a082a6fca7ecba190dc8
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
dllhost.exepid process 2652 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 368 schtasks.exe 3936 schtasks.exe 4864 schtasks.exe 1188 schtasks.exe 4976 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedllhost.exepid process 2312 powershell.exe 2312 powershell.exe 2312 powershell.exe 1728 powershell.exe 1728 powershell.exe 1728 powershell.exe 2360 powershell.exe 2360 powershell.exe 2360 powershell.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe 2652 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exe3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exepowershell.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 2312 powershell.exe Token: SeDebugPrivilege 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe Token: SeDebugPrivilege 1728 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeDebugPrivilege 2652 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.execmd.exedllhost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3768 wrote to memory of 4524 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe cmd.exe PID 3768 wrote to memory of 4524 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe cmd.exe PID 3768 wrote to memory of 4524 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe cmd.exe PID 4524 wrote to memory of 3464 4524 cmd.exe chcp.com PID 4524 wrote to memory of 3464 4524 cmd.exe chcp.com PID 4524 wrote to memory of 3464 4524 cmd.exe chcp.com PID 4524 wrote to memory of 2312 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 2312 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 2312 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 1728 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 1728 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 1728 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 2360 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 2360 4524 cmd.exe powershell.exe PID 4524 wrote to memory of 2360 4524 cmd.exe powershell.exe PID 3768 wrote to memory of 2652 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe dllhost.exe PID 3768 wrote to memory of 2652 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe dllhost.exe PID 3768 wrote to memory of 2652 3768 3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe dllhost.exe PID 2652 wrote to memory of 4484 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4484 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4484 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 3132 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 3132 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 3132 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1996 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1996 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1996 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 2188 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 2188 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 2188 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1348 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1348 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1348 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1920 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1920 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 1920 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4136 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4136 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4136 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4552 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4552 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4552 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4384 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4384 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4384 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 3820 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 3820 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 3820 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4164 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4164 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4164 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4676 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4676 2652 dllhost.exe cmd.exe PID 2652 wrote to memory of 4676 2652 dllhost.exe cmd.exe PID 4484 wrote to memory of 368 4484 cmd.exe schtasks.exe PID 4484 wrote to memory of 368 4484 cmd.exe schtasks.exe PID 4484 wrote to memory of 368 4484 cmd.exe schtasks.exe PID 2188 wrote to memory of 4864 2188 cmd.exe schtasks.exe PID 2188 wrote to memory of 4864 2188 cmd.exe schtasks.exe PID 2188 wrote to memory of 4864 2188 cmd.exe schtasks.exe PID 4136 wrote to memory of 3936 4136 cmd.exe schtasks.exe PID 4136 wrote to memory of 3936 4136 cmd.exe schtasks.exe PID 4136 wrote to memory of 3936 4136 cmd.exe schtasks.exe PID 1996 wrote to memory of 1188 1996 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe"C:\Users\Admin\AppData\Local\Temp\3d8db43890583ed881e78c4d87910b5d888a5a2d4e28f244b1173340edd9283c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8779" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8779" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6756" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9737" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1909" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
918KB
MD5fc2b7fcfe1723f3bb59d5d069c13f5c0
SHA12c0c106eccac0138cdbe4e5e1bdc820d756d9b8c
SHA2569c4c61c3ac6ea060354028fca7ced3aee88902b3ed625f06198d162786217412
SHA512f86df505c169eb431cde84cbcb9c4db4c7173895ab5b8e012738cb8261bcb7c210c375a298b040c6bbd0e1341797bc47a68caa44be922ea2cb4adf6679b8e7f6
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
918KB
MD5fc2b7fcfe1723f3bb59d5d069c13f5c0
SHA12c0c106eccac0138cdbe4e5e1bdc820d756d9b8c
SHA2569c4c61c3ac6ea060354028fca7ced3aee88902b3ed625f06198d162786217412
SHA512f86df505c169eb431cde84cbcb9c4db4c7173895ab5b8e012738cb8261bcb7c210c375a298b040c6bbd0e1341797bc47a68caa44be922ea2cb4adf6679b8e7f6
-
C:\ProgramData\HostData\logs.uceFilesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD56c9bc97bfdcd7842d76d25b20af2675a
SHA166213169893fc9b3ec7728e0eaf369688b99d2b6
SHA25633d74b2f63ceb46e89e47dfeac79a11ae9a2aef1d9f2e77d832d614cf9630434
SHA5128cdc00f9b5ecf212eec240dffff3d2a5601f404f3e175325cc95335a67136ac845826e8bdbafe6181feae7ddf65749e1fbd66becda2edbb1e492033eb810a470
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5b59f2c0509f2c28821ca5fbcd04c5c51
SHA16dc10ac933332e6b26e7aeecc7366cd2062abadd
SHA256229a930c571e188052757e6fea706dd69c0618b5e5f7d30da1195a316200e33c
SHA5122123e4283a5a4582e023b0958652c53ae7e8b543fa7f50c6b5dd51531a3c752b69de0e9037688556f9e7c39c252d4be07de6956303bc30ade3769301a5a736d0
-
memory/368-1089-0x0000000000000000-mapping.dmp
-
memory/1012-1436-0x0000000000000000-mapping.dmp
-
memory/1188-1098-0x0000000000000000-mapping.dmp
-
memory/1348-1001-0x0000000000000000-mapping.dmp
-
memory/1572-1442-0x0000000000000000-mapping.dmp
-
memory/1716-1407-0x0000000000000000-mapping.dmp
-
memory/1728-524-0x0000000000000000-mapping.dmp
-
memory/1920-1007-0x0000000000000000-mapping.dmp
-
memory/1996-991-0x0000000000000000-mapping.dmp
-
memory/2188-996-0x0000000000000000-mapping.dmp
-
memory/2312-227-0x0000000007450000-0x0000000007A78000-memory.dmpFilesize
6.2MB
-
memory/2312-255-0x0000000007CF0000-0x0000000007D0C000-memory.dmpFilesize
112KB
-
memory/2312-187-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2312-186-0x0000000000000000-mapping.dmp
-
memory/2312-222-0x0000000006DE0000-0x0000000006E16000-memory.dmpFilesize
216KB
-
memory/2312-506-0x00000000098D0000-0x00000000098D8000-memory.dmpFilesize
32KB
-
memory/2312-501-0x00000000098E0000-0x00000000098FA000-memory.dmpFilesize
104KB
-
memory/2312-298-0x0000000009930000-0x00000000099C4000-memory.dmpFilesize
592KB
-
memory/2312-294-0x00000000096A0000-0x0000000009745000-memory.dmpFilesize
660KB
-
memory/2312-285-0x0000000009620000-0x000000000963E000-memory.dmpFilesize
120KB
-
memory/2312-284-0x0000000009660000-0x0000000009693000-memory.dmpFilesize
204KB
-
memory/2312-269-0x0000000008670000-0x00000000086E6000-memory.dmpFilesize
472KB
-
memory/2312-257-0x0000000008620000-0x000000000866B000-memory.dmpFilesize
300KB
-
memory/2312-244-0x0000000007AF0000-0x0000000007B12000-memory.dmpFilesize
136KB
-
memory/2312-248-0x0000000007E50000-0x00000000081A0000-memory.dmpFilesize
3.3MB
-
memory/2312-247-0x0000000007B90000-0x0000000007BF6000-memory.dmpFilesize
408KB
-
memory/2360-835-0x0000000000000000-mapping.dmp
-
memory/2652-951-0x0000000000300000-0x00000000003B0000-memory.dmpFilesize
704KB
-
memory/2652-899-0x0000000000000000-mapping.dmp
-
memory/3132-988-0x0000000000000000-mapping.dmp
-
memory/3464-178-0x0000000000000000-mapping.dmp
-
memory/3464-185-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3464-184-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3464-183-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3464-182-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3464-181-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3464-180-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3464-179-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-145-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-142-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-162-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-163-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-164-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-165-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-166-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-167-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-168-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-169-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-170-0x0000000005530000-0x000000000553A000-memory.dmpFilesize
40KB
-
memory/3768-171-0x00000000056D0000-0x0000000005736000-memory.dmpFilesize
408KB
-
memory/3768-117-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-118-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-119-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-120-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-121-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-122-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-160-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-159-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-158-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-157-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-156-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-155-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-154-0x0000000005480000-0x0000000005512000-memory.dmpFilesize
584KB
-
memory/3768-153-0x0000000005AA0000-0x0000000005F9E000-memory.dmpFilesize
5.0MB
-
memory/3768-152-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-151-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-150-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-149-0x0000000000BB0000-0x0000000000C58000-memory.dmpFilesize
672KB
-
memory/3768-148-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-147-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-146-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-116-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-144-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-143-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-141-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-161-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-140-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-139-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-138-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-137-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-136-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-135-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-134-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-133-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-131-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-132-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-130-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-129-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-127-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-123-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-128-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-126-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-124-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3768-125-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3820-1031-0x0000000000000000-mapping.dmp
-
memory/3936-1095-0x0000000000000000-mapping.dmp
-
memory/4136-1013-0x0000000000000000-mapping.dmp
-
memory/4164-1037-0x0000000000000000-mapping.dmp
-
memory/4384-1025-0x0000000000000000-mapping.dmp
-
memory/4428-1413-0x0000000000000000-mapping.dmp
-
memory/4484-986-0x0000000000000000-mapping.dmp
-
memory/4512-1469-0x0000000000000000-mapping.dmp
-
memory/4524-175-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4524-176-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4524-177-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4524-174-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4524-173-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4524-172-0x0000000000000000-mapping.dmp
-
memory/4552-1019-0x0000000000000000-mapping.dmp
-
memory/4676-1045-0x0000000000000000-mapping.dmp
-
memory/4864-1093-0x0000000000000000-mapping.dmp
-
memory/4960-1475-0x0000000000000000-mapping.dmp
-
memory/4976-1129-0x0000000000000000-mapping.dmp