Analysis
-
max time kernel
152s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe
Resource
win10v2004-20220901-en
General
-
Target
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe
-
Size
208KB
-
MD5
e1c1de71aeb158e88bd6e07d8aa2e490
-
SHA1
d37d41fd8702558bc10496e154bc94a823f8cbf8
-
SHA256
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539
-
SHA512
8f2dea186d961416ad5e7938cd914319656f4873e8af56d677d6da3b15fe2dc4b3202235c0020dca281d35998e39ca37173a9d1e7cc2f1af9541f4dadce12510
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 912 svhust.exe 576 svhust.exe 628 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1640-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1640-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1640-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1640-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1640-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/628-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/628-97-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/628-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1640-105-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/628-106-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/628-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/628-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/576-109-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/628-112-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/576-113-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exepid process 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exesvhust.exedescription pid process target process PID 1428 set thread context of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 912 set thread context of 576 912 svhust.exe svhust.exe PID 912 set thread context of 628 912 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe Token: SeDebugPrivilege 576 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 628 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exee6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exesvhust.exesvhust.exepid process 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe 912 svhust.exe 576 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exee6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.execmd.exesvhust.exedescription pid process target process PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1428 wrote to memory of 1640 1428 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe PID 1640 wrote to memory of 1828 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe cmd.exe PID 1640 wrote to memory of 1828 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe cmd.exe PID 1640 wrote to memory of 1828 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe cmd.exe PID 1640 wrote to memory of 1828 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe cmd.exe PID 1828 wrote to memory of 1836 1828 cmd.exe reg.exe PID 1828 wrote to memory of 1836 1828 cmd.exe reg.exe PID 1828 wrote to memory of 1836 1828 cmd.exe reg.exe PID 1828 wrote to memory of 1836 1828 cmd.exe reg.exe PID 1640 wrote to memory of 912 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe svhust.exe PID 1640 wrote to memory of 912 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe svhust.exe PID 1640 wrote to memory of 912 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe svhust.exe PID 1640 wrote to memory of 912 1640 e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 576 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe PID 912 wrote to memory of 628 912 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe"C:\Users\Admin\AppData\Local\Temp\e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe"C:\Users\Admin\AppData\Local\Temp\e6238cbf33635ad21f04edb1dd407b999edcf522c8983c73faf646f684a1f539.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XWIQH.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1836 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:576 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XWIQH.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5b09dec2400a0cacb7945970d79659cc1
SHA1d5afc91ad63727832eb7147fba7be384c78d0d51
SHA256c6642f96747efac4b4c18bdd5935b50b4e299ba8870d3b030775aeb7b0d5e0c0
SHA512c69d9a9ac2ac217cefb3fd6105e27aa4ce0528e7a1bf7781e3fc5acff5823de3f8dfc44f923a8fb3fa607fbb02c5cc1518375df40408740f165488a47306b9ad
-
memory/576-109-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/576-89-0x00000000004085D0-mapping.dmp
-
memory/576-113-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/628-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-100-0x0000000000476940-mapping.dmp
-
memory/628-110-0x00000000742B1000-0x00000000742B3000-memory.dmpFilesize
8KB
-
memory/628-97-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-112-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/628-106-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/912-81-0x00000000004ED000-0x0000000000502000-memory.dmpFilesize
84KB
-
memory/912-77-0x0000000000000000-mapping.dmp
-
memory/1428-56-0x000000000056D000-0x0000000000583000-memory.dmpFilesize
88KB
-
memory/1640-63-0x00000000004085D0-mapping.dmp
-
memory/1640-69-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/1640-105-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1640-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1640-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1640-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1640-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1640-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1640-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1828-70-0x0000000000000000-mapping.dmp
-
memory/1836-72-0x0000000000000000-mapping.dmp