Analysis
-
max time kernel
189s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe
Resource
win10v2004-20220812-en
General
-
Target
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe
-
Size
208KB
-
MD5
0c6c3a059440685979a2a4b68f290fc0
-
SHA1
eb190a51e811de586056ef32ed540ee8f2fd8b9c
-
SHA256
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c
-
SHA512
89aebb79c54cbf791be78e1329f879ce6717929b3de0e53a910f6b45942ae73de60a0d6aeda7f06f6d3f148bee53a8e70dac7593048dde9658a86f734b811781
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1800 svhust.exe 1108 svhust.exe 1516 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1484-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1484-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1484-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1484-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1484-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1484-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1516-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1516-100-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1484-104-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1516-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1516-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1516-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1516-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1108-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1516-112-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1516-114-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1108-115-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exepid process 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exesvhust.exedescription pid process target process PID 2016 set thread context of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 1800 set thread context of 1108 1800 svhust.exe svhust.exe PID 1800 set thread context of 1516 1800 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe Token: SeDebugPrivilege 1108 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1516 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exesvhust.exesvhust.exepid process 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 1800 svhust.exe 1108 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.execmd.exesvhust.exedescription pid process target process PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 2016 wrote to memory of 1484 2016 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe PID 1484 wrote to memory of 1920 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe cmd.exe PID 1484 wrote to memory of 1920 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe cmd.exe PID 1484 wrote to memory of 1920 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe cmd.exe PID 1484 wrote to memory of 1920 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe cmd.exe PID 1920 wrote to memory of 1000 1920 cmd.exe reg.exe PID 1920 wrote to memory of 1000 1920 cmd.exe reg.exe PID 1920 wrote to memory of 1000 1920 cmd.exe reg.exe PID 1920 wrote to memory of 1000 1920 cmd.exe reg.exe PID 1484 wrote to memory of 1800 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe svhust.exe PID 1484 wrote to memory of 1800 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe svhust.exe PID 1484 wrote to memory of 1800 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe svhust.exe PID 1484 wrote to memory of 1800 1484 82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1108 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe PID 1800 wrote to memory of 1516 1800 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe"C:\Users\Admin\AppData\Local\Temp\82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe"C:\Users\Admin\AppData\Local\Temp\82d15dc51edd2b0fd89f3908255cd397d6a7ab086f755fd220274b0293c3614c.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WESRD.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1000 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1108 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WESRD.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD56b56c4ffec9a7d39f451717afd685a46
SHA10454dcddf4e9ed9e730cd13adea87d6254eea190
SHA256eb14ffae0115203e3af19addc0268dea3c7e78897bef163ca93f2a763c40ac4a
SHA5129a13d7dddb8e8ad08c45a3772b03e1445a4d51d188fbe88faf316aab5a2471714e2fa5884fd0c05aac9be6d85918c657626a296f05c7027d77e770ec76b4b60d
-
memory/1000-73-0x0000000000000000-mapping.dmp
-
memory/1108-90-0x00000000004085D0-mapping.dmp
-
memory/1108-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1108-115-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-70-0x0000000076AE1000-0x0000000076AE3000-memory.dmpFilesize
8KB
-
memory/1484-104-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1484-63-0x00000000004085D0-mapping.dmp
-
memory/1484-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1516-109-0x0000000074EF1000-0x0000000074EF3000-memory.dmpFilesize
8KB
-
memory/1516-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-114-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-112-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-102-0x0000000000476940-mapping.dmp
-
memory/1516-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-100-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1516-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1800-78-0x0000000000000000-mapping.dmp
-
memory/1800-82-0x000000000061D000-0x0000000000632000-memory.dmpFilesize
84KB
-
memory/1920-71-0x0000000000000000-mapping.dmp
-
memory/2016-56-0x000000000050D000-0x0000000000523000-memory.dmpFilesize
88KB