Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe
Resource
win10v2004-20221111-en
General
-
Target
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe
-
Size
208KB
-
MD5
1b80cb5715a2325f69db8f4fc1995da0
-
SHA1
9714566d570099988afff4dc09b31f220fa4c5e1
-
SHA256
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8
-
SHA512
5c6795ea6a1c77dc140bbee8aedeb86b2dcf23deedeb8a77d87933e0a3300d9ef4174e538525b14f4182fd71ab69058a8f0a0c3d35ff93b6c6e295dd71ddefec
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1144 svhust.exe 700 svhust.exe 1096 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1776-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1776-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1776-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1776-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1776-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1776-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1096-95-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1096-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1096-100-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1096-106-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1776-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1096-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/700-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1096-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/700-114-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1096-113-0x0000000000400000-0x0000000000479000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exepid process 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exesvhust.exedescription pid process target process PID 860 set thread context of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 1144 set thread context of 700 1144 svhust.exe svhust.exe PID 1144 set thread context of 1096 1144 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe Token: SeDebugPrivilege 700 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1096 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exesvhust.exesvhust.exepid process 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 1144 svhust.exe 700 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.execmd.exesvhust.exedescription pid process target process PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 860 wrote to memory of 1776 860 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe PID 1776 wrote to memory of 1536 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe cmd.exe PID 1776 wrote to memory of 1536 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe cmd.exe PID 1776 wrote to memory of 1536 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe cmd.exe PID 1776 wrote to memory of 1536 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe cmd.exe PID 1536 wrote to memory of 1056 1536 cmd.exe reg.exe PID 1536 wrote to memory of 1056 1536 cmd.exe reg.exe PID 1536 wrote to memory of 1056 1536 cmd.exe reg.exe PID 1536 wrote to memory of 1056 1536 cmd.exe reg.exe PID 1776 wrote to memory of 1144 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe svhust.exe PID 1776 wrote to memory of 1144 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe svhust.exe PID 1776 wrote to memory of 1144 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe svhust.exe PID 1776 wrote to memory of 1144 1776 6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 700 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe PID 1144 wrote to memory of 1096 1144 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe"C:\Users\Admin\AppData\Local\Temp\6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe"C:\Users\Admin\AppData\Local\Temp\6704b39d075aeedf60893ffac549ab8622a8b5580adbe612e4417d7e110249c8.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KSGRH.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1056 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:700 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1096
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\KSGRH.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD53103dec1110bf0ecd6c1c3a3bc5ba62e
SHA1f07027e56a6c2d5f859436a72514dbe417adb223
SHA25697c9e9e9ae04521f4057954f797b0e71e0f749f3291422f38e53f975e998d9c3
SHA512aa9dd5d97730b143a5029ee106f6eba2afac2bebd59e6477948f9cb3890b61a6fd9011cda654ceed4e2335ca9c4c91dc93a98c4c2b582582ee654d0abfccd1e3
-
memory/700-90-0x00000000004085D0-mapping.dmp
-
memory/700-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/700-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/860-56-0x000000000053D000-0x0000000000553000-memory.dmpFilesize
88KB
-
memory/1056-73-0x0000000000000000-mapping.dmp
-
memory/1096-101-0x0000000000476940-mapping.dmp
-
memory/1096-106-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-109-0x0000000074291000-0x0000000074293000-memory.dmpFilesize
8KB
-
memory/1096-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-95-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1096-100-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1144-78-0x0000000000000000-mapping.dmp
-
memory/1144-82-0x000000000054D000-0x0000000000562000-memory.dmpFilesize
84KB
-
memory/1536-71-0x0000000000000000-mapping.dmp
-
memory/1776-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-63-0x00000000004085D0-mapping.dmp
-
memory/1776-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1776-70-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB