Analysis
-
max time kernel
154s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe
Resource
win10v2004-20220812-en
General
-
Target
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe
-
Size
208KB
-
MD5
afd35835b446dac7153cffdfd0e48fb0
-
SHA1
9aef34c4db3a0e7b69400acc2b6fd823c8a4242d
-
SHA256
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4
-
SHA512
78eaa89c4cce8ef8257b48277953276be2cafcdcb45ebac202e74cb88bece386cb6a3ef0e89763b0a7e1dd9380b9705ddd2826576e41b33bf0ea9f47b424d3b6
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 908 svhust.exe 1488 svhust.exe 824 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1932-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1932-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1932-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1932-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1932-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1932-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/824-95-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1932-105-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/824-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1488-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/824-113-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1488-114-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exepid process 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exesvhust.exedescription pid process target process PID 1132 set thread context of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 908 set thread context of 1488 908 svhust.exe svhust.exe PID 908 set thread context of 824 908 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 824 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exed5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exesvhust.exesvhust.exepid process 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe 908 svhust.exe 1488 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exed5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.execmd.exesvhust.exedescription pid process target process PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1132 wrote to memory of 1932 1132 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe PID 1932 wrote to memory of 2032 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe cmd.exe PID 1932 wrote to memory of 2032 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe cmd.exe PID 1932 wrote to memory of 2032 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe cmd.exe PID 1932 wrote to memory of 2032 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe cmd.exe PID 2032 wrote to memory of 2000 2032 cmd.exe reg.exe PID 2032 wrote to memory of 2000 2032 cmd.exe reg.exe PID 2032 wrote to memory of 2000 2032 cmd.exe reg.exe PID 2032 wrote to memory of 2000 2032 cmd.exe reg.exe PID 1932 wrote to memory of 908 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe svhust.exe PID 1932 wrote to memory of 908 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe svhust.exe PID 1932 wrote to memory of 908 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe svhust.exe PID 1932 wrote to memory of 908 1932 d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 1488 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe PID 908 wrote to memory of 824 908 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe"C:\Users\Admin\AppData\Local\Temp\d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe"C:\Users\Admin\AppData\Local\Temp\d5a6bf6bd9ade7459e6035f31062330aa9c4a4fad5c522caddc37eb998e3c1c4.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PUABH.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:2000 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1488 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PUABH.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5116e820d86448b7f4a5424ea766ec41d
SHA15e7774a4e14c529125050c583823116cc43a9c7a
SHA256d952aea80cf6f4d3272cb5c1a13520d03e590c392da8d0ffa869e139c33f7858
SHA51275a3b3d934d18a2cc772c67a567eac372d1b9222983ac132fdf407572188a257b25639cfe9d62805cb64eabf9fbbebb10df29a96e54fec293968868de8175a4a
-
memory/824-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-95-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-101-0x0000000000476940-mapping.dmp
-
memory/824-109-0x0000000074821000-0x0000000074823000-memory.dmpFilesize
8KB
-
memory/824-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/908-78-0x0000000000000000-mapping.dmp
-
memory/908-82-0x00000000008DD000-0x00000000008F2000-memory.dmpFilesize
84KB
-
memory/1132-56-0x000000000060D000-0x0000000000623000-memory.dmpFilesize
88KB
-
memory/1488-90-0x00000000004085D0-mapping.dmp
-
memory/1488-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1488-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-63-0x00000000004085D0-mapping.dmp
-
memory/1932-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-105-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-70-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1932-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1932-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2000-73-0x0000000000000000-mapping.dmp
-
memory/2032-71-0x0000000000000000-mapping.dmp