Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe
Resource
win10v2004-20220812-en
General
-
Target
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe
-
Size
208KB
-
MD5
4b67b004f28fc8341542fb93ac610b60
-
SHA1
98165ecd761e4916732599715cd5cb049d96c25f
-
SHA256
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c
-
SHA512
5d600454f793f7138bb38358a55893135682c6540a44fecd43abe8cb9691ec121f749bd6ebe23377687cff7a5a86250d4a4b5d64edb0613b9c7b50167782960d
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 320 svhust.exe 1384 svhust.exe 2008 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1080-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1080-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2008-95-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2008-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2008-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1080-104-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2008-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2008-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/2008-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1384-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2008-113-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1384-114-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exepid process 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exesvhust.exedescription pid process target process PID 1284 set thread context of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 320 set thread context of 1384 320 svhust.exe svhust.exe PID 320 set thread context of 2008 320 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe Token: SeDebugPrivilege 1384 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 2008 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exebda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exesvhust.exesvhust.exepid process 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe 320 svhust.exe 1384 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exebda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.execmd.exesvhust.exedescription pid process target process PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1284 wrote to memory of 1080 1284 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe PID 1080 wrote to memory of 1720 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe cmd.exe PID 1080 wrote to memory of 1720 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe cmd.exe PID 1080 wrote to memory of 1720 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe cmd.exe PID 1080 wrote to memory of 1720 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe cmd.exe PID 1720 wrote to memory of 764 1720 cmd.exe reg.exe PID 1720 wrote to memory of 764 1720 cmd.exe reg.exe PID 1720 wrote to memory of 764 1720 cmd.exe reg.exe PID 1720 wrote to memory of 764 1720 cmd.exe reg.exe PID 1080 wrote to memory of 320 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe svhust.exe PID 1080 wrote to memory of 320 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe svhust.exe PID 1080 wrote to memory of 320 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe svhust.exe PID 1080 wrote to memory of 320 1080 bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 1384 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe PID 320 wrote to memory of 2008 320 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe"C:\Users\Admin\AppData\Local\Temp\bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe"C:\Users\Admin\AppData\Local\Temp\bda62cd70d9ea65a973dfbf8525aa0024edd8fa6d633abf9c7149811b88c631c.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PTFGD.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:764 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1384 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:2008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PTFGD.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56475edcc6b06a3c5ae245928085a1421
SHA1e6976d93866b7ee2626f6adbb49a6dfd3fcafc86
SHA2564acc14e7898895c8c2cac39935f67330612ac446906bb28b85f62a1512f55309
SHA512ed8d06f536c79e98564cd83a8b630a4cd496c73b4ae66ad87243794f1f3925e5cb22de17b2713d158d938ef4c0a66baff68b5904cdd3ec086563683b4ff04d5f
-
memory/320-82-0x00000000005FD000-0x0000000000612000-memory.dmpFilesize
84KB
-
memory/320-78-0x0000000000000000-mapping.dmp
-
memory/764-73-0x0000000000000000-mapping.dmp
-
memory/1080-70-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB
-
memory/1080-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-63-0x00000000004085D0-mapping.dmp
-
memory/1080-104-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1080-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1284-56-0x000000000053D000-0x0000000000553000-memory.dmpFilesize
88KB
-
memory/1384-90-0x00000000004085D0-mapping.dmp
-
memory/1384-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1384-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1720-71-0x0000000000000000-mapping.dmp
-
memory/2008-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-101-0x0000000000476940-mapping.dmp
-
memory/2008-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-109-0x0000000074E41000-0x0000000074E43000-memory.dmpFilesize
8KB
-
memory/2008-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-95-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2008-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB