Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe
Resource
win10v2004-20220812-en
General
-
Target
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe
-
Size
208KB
-
MD5
a7c776e5a1af6a40b81da1534efb2f10
-
SHA1
7074227f6290edfe796684ae92c65324ba4edd44
-
SHA256
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9
-
SHA512
ee411699c99fcfc422eaff7680bb9664f3a12f924a77d06c737a60816550fd268820192dfe4eee28c899305d5d83f620ca90916cccb7602e824082409df3521a
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1572 svhust.exe 772 svhust.exe 1920 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/816-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/816-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/816-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/816-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/816-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/816-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-95-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1920-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1920-100-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1920-106-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/816-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1920-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1920-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/772-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/772-113-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exepid process 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exesvhust.exedescription pid process target process PID 1032 set thread context of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1572 set thread context of 772 1572 svhust.exe svhust.exe PID 1572 set thread context of 1920 1572 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe Token: SeDebugPrivilege 772 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1920 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exesvhust.exesvhust.exepid process 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 1572 svhust.exe 772 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.execmd.exesvhust.exedescription pid process target process PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 1032 wrote to memory of 816 1032 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe PID 816 wrote to memory of 1544 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe cmd.exe PID 816 wrote to memory of 1544 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe cmd.exe PID 816 wrote to memory of 1544 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe cmd.exe PID 816 wrote to memory of 1544 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe cmd.exe PID 1544 wrote to memory of 1720 1544 cmd.exe reg.exe PID 1544 wrote to memory of 1720 1544 cmd.exe reg.exe PID 1544 wrote to memory of 1720 1544 cmd.exe reg.exe PID 1544 wrote to memory of 1720 1544 cmd.exe reg.exe PID 816 wrote to memory of 1572 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe svhust.exe PID 816 wrote to memory of 1572 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe svhust.exe PID 816 wrote to memory of 1572 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe svhust.exe PID 816 wrote to memory of 1572 816 7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 772 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe PID 1572 wrote to memory of 1920 1572 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe"C:\Users\Admin\AppData\Local\Temp\7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe"C:\Users\Admin\AppData\Local\Temp\7466584c38d78c280b7300d636fc4b150af170b3968387631f1d0cc03d61c7e9.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JWDMW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1720 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:772 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1920
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\JWDMW.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5c717cd80563b6a7370a2d6d5f75c8a10
SHA1cef6dc4739be4e4116d0da7faa6673639ffac52a
SHA25636c64b8f0082a4e62eba8a02e1a8adaeb832333213c5ca0ff00e5138290a6fc9
SHA512f646f4b730a9ae68425fd37442e8dfcdb561c043a6bcf09443a8d2746ba331e1cae84ee54ca81bf87bcbf216f43be02a014034aeaef8938dc3912559a4713bf7
-
memory/772-113-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/772-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/772-90-0x00000000004085D0-mapping.dmp
-
memory/816-70-0x0000000076711000-0x0000000076713000-memory.dmpFilesize
8KB
-
memory/816-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-63-0x00000000004085D0-mapping.dmp
-
memory/1032-56-0x000000000059D000-0x00000000005B3000-memory.dmpFilesize
88KB
-
memory/1544-71-0x0000000000000000-mapping.dmp
-
memory/1572-82-0x000000000056D000-0x0000000000582000-memory.dmpFilesize
84KB
-
memory/1572-78-0x0000000000000000-mapping.dmp
-
memory/1720-73-0x0000000000000000-mapping.dmp
-
memory/1920-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1920-101-0x0000000000476940-mapping.dmp
-
memory/1920-106-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1920-100-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1920-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1920-109-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1920-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1920-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1920-95-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB