Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe
Resource
win10v2004-20221111-en
General
-
Target
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe
-
Size
208KB
-
MD5
0b2c9c9ddb7befef10b7696664197ce0
-
SHA1
94ed8f9efc4ec9323a521a8f04a2f7c188b151b0
-
SHA256
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28
-
SHA512
8d80d350607d99350ddf9972578a2a68c628935d2663d8d51fa56eeed0694aeae46c346373b194c0897165251a917e20cb3f0165ff7c366479aa39b97d7b7ab1
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 668 svhust.exe 1488 svhust.exe 940 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1672-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1672-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1672-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1672-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1672-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1672-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/940-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/940-97-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/940-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1672-102-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/940-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/940-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/940-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1488-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1488-113-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exepid process 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svhust.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exesvhust.exedescription pid process target process PID 1076 set thread context of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 668 set thread context of 1488 668 svhust.exe svhust.exe PID 668 set thread context of 940 668 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe Token: SeDebugPrivilege 1488 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 940 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.execff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exesvhust.exesvhust.exepid process 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe 668 svhust.exe 1488 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.execff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.execmd.exesvhust.exedescription pid process target process PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1076 wrote to memory of 1672 1076 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe PID 1672 wrote to memory of 1396 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cmd.exe PID 1672 wrote to memory of 1396 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cmd.exe PID 1672 wrote to memory of 1396 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cmd.exe PID 1672 wrote to memory of 1396 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe cmd.exe PID 1396 wrote to memory of 960 1396 cmd.exe reg.exe PID 1396 wrote to memory of 960 1396 cmd.exe reg.exe PID 1396 wrote to memory of 960 1396 cmd.exe reg.exe PID 1396 wrote to memory of 960 1396 cmd.exe reg.exe PID 1672 wrote to memory of 668 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe svhust.exe PID 1672 wrote to memory of 668 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe svhust.exe PID 1672 wrote to memory of 668 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe svhust.exe PID 1672 wrote to memory of 668 1672 cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 1488 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe PID 668 wrote to memory of 940 668 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe"C:\Users\Admin\AppData\Local\Temp\cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe"C:\Users\Admin\AppData\Local\Temp\cff1a0eb4d9422886aed9827a0613e58fbd7c732152a3bdaa005e4c931547a28.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EJYAX.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:960 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1488 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EJYAX.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53e5f6e6562176311eca043b10149736c
SHA1e72bf5b262a930046a99395b82de5b7b3a7d0bdd
SHA25621dda277196b80d6f587f1826905f7ca64bf48da8a141257f8b2875d53d83a71
SHA512878525c9c23276f2185aefda45804cb0ceac81772e40a5c76dce401a9f77575237c5c168281c8825a6eed83eb06e7bf064244ab282a83d691e4578254d5cd333
-
memory/668-82-0x00000000002AD000-0x00000000002C2000-memory.dmpFilesize
84KB
-
memory/668-78-0x0000000000000000-mapping.dmp
-
memory/940-100-0x0000000000476940-mapping.dmp
-
memory/940-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/940-109-0x0000000074531000-0x0000000074533000-memory.dmpFilesize
8KB
-
memory/940-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/940-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/940-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/940-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/940-97-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/940-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/960-73-0x0000000000000000-mapping.dmp
-
memory/1076-56-0x000000000055D000-0x0000000000573000-memory.dmpFilesize
88KB
-
memory/1396-71-0x0000000000000000-mapping.dmp
-
memory/1488-90-0x00000000004085D0-mapping.dmp
-
memory/1488-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1488-113-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-102-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-63-0x00000000004085D0-mapping.dmp
-
memory/1672-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1672-70-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1672-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB