Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe
Resource
win10v2004-20221111-en
General
-
Target
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe
-
Size
208KB
-
MD5
a478f42505f950c7a715fbd49075fbe0
-
SHA1
6e42165ab9da53bda02f405aa78221ec7d4dffc4
-
SHA256
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0
-
SHA512
e969877a0c6bd8e997061e9c0eebf8dd4ccf9c23bc397cdb53a74323b1f6f39527df0c62c8184b14ae5a7ef2dc9de29ee26eeb34f35f65d1208b4fe2907d6c85
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 952 svhust.exe 764 svhust.exe 1260 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1920-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1260-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1260-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1260-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1920-106-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1260-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1260-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1260-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/764-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1260-113-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/764-114-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exepid process 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe File created C:\Windows\System32\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exesvhust.exedescription pid process target process PID 1896 set thread context of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 952 set thread context of 764 952 svhust.exe svhust.exe PID 952 set thread context of 1260 952 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe Token: SeDebugPrivilege 764 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1260 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exesvhust.exesvhust.exepid process 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 952 svhust.exe 764 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.execmd.exesvhust.exedescription pid process target process PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1896 wrote to memory of 1920 1896 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe PID 1920 wrote to memory of 1348 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe cmd.exe PID 1920 wrote to memory of 1348 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe cmd.exe PID 1920 wrote to memory of 1348 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe cmd.exe PID 1920 wrote to memory of 1348 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe cmd.exe PID 1348 wrote to memory of 1740 1348 cmd.exe reg.exe PID 1348 wrote to memory of 1740 1348 cmd.exe reg.exe PID 1348 wrote to memory of 1740 1348 cmd.exe reg.exe PID 1348 wrote to memory of 1740 1348 cmd.exe reg.exe PID 1920 wrote to memory of 952 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe svhust.exe PID 1920 wrote to memory of 952 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe svhust.exe PID 1920 wrote to memory of 952 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe svhust.exe PID 1920 wrote to memory of 952 1920 927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 764 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe PID 952 wrote to memory of 1260 952 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe"C:\Users\Admin\AppData\Local\Temp\927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe"C:\Users\Admin\AppData\Local\Temp\927120183cda5bb597632a67c9a6ef718458aa3c8e6244ca0540e1e84ea99cb0.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HUTGO.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1740 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:764 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HUTGO.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5830c7ed8058194bcae4a77e43625c6b0
SHA1cfb076d0ee93b0c27471c684c8fc52c7e2d61348
SHA25640613be15bab10b67bef562fd9f8754a7e6ba36f14b7446d4e63add757761a9f
SHA5125707aa3429ca395a883e3f51ddadd6bbc7d4e23ab2c0b376a22e6f275944a2eaa83cce38e9e8259dd6db74d01594246b60dc57ebef543ea5ae83911ee08a7a31
-
memory/764-90-0x00000000004085D0-mapping.dmp
-
memory/764-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/764-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/952-78-0x0000000000000000-mapping.dmp
-
memory/952-82-0x000000000062D000-0x0000000000642000-memory.dmpFilesize
84KB
-
memory/1260-100-0x0000000000476940-mapping.dmp
-
memory/1260-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-109-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1260-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1260-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1348-71-0x0000000000000000-mapping.dmp
-
memory/1740-73-0x0000000000000000-mapping.dmp
-
memory/1896-56-0x000000000063D000-0x0000000000653000-memory.dmpFilesize
88KB
-
memory/1920-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-106-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-70-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/1920-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1920-63-0x00000000004085D0-mapping.dmp
-
memory/1920-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB