Analysis
-
max time kernel
151s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe
Resource
win10v2004-20220901-en
General
-
Target
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe
-
Size
208KB
-
MD5
e6067de41ee456ac879ed49eaf452ce0
-
SHA1
b38b0293cb268f28de80b589b09eca552c898242
-
SHA256
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734
-
SHA512
654242f32c6f04140c91acdee9bd27624ac077bbee7a2453ad91cdd985f4e46ceff215e1a56431f0c810062222222c6e634d40054bb0cf79bb65da80358deec7
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1104 svhust.exe 1816 svhust.exe 1820 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1644-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1644-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1644-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1644-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1644-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1644-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1820-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1820-97-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1820-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1644-104-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1820-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1820-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1820-109-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1816-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1820-113-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1816-114-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exepid process 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svhust.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exesvhust.exedescription pid process target process PID 1452 set thread context of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1104 set thread context of 1816 1104 svhust.exe svhust.exe PID 1104 set thread context of 1820 1104 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe Token: SeDebugPrivilege 1816 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1820 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exesvhust.exesvhust.exepid process 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 1104 svhust.exe 1816 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.execmd.exesvhust.exedescription pid process target process PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1452 wrote to memory of 1644 1452 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe PID 1644 wrote to memory of 1080 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe cmd.exe PID 1644 wrote to memory of 1080 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe cmd.exe PID 1644 wrote to memory of 1080 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe cmd.exe PID 1644 wrote to memory of 1080 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe cmd.exe PID 1080 wrote to memory of 1648 1080 cmd.exe reg.exe PID 1080 wrote to memory of 1648 1080 cmd.exe reg.exe PID 1080 wrote to memory of 1648 1080 cmd.exe reg.exe PID 1080 wrote to memory of 1648 1080 cmd.exe reg.exe PID 1644 wrote to memory of 1104 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe svhust.exe PID 1644 wrote to memory of 1104 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe svhust.exe PID 1644 wrote to memory of 1104 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe svhust.exe PID 1644 wrote to memory of 1104 1644 5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1816 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe PID 1104 wrote to memory of 1820 1104 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe"C:\Users\Admin\AppData\Local\Temp\5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe"C:\Users\Admin\AppData\Local\Temp\5a0787c7188223710640cafbb82db7fede732342952f87448dc8a03e664cd734.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\AQROW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1648 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1816 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AQROW.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51c3ea32c0864828b7e9552c9be224861
SHA101a609cb2185404bfa6e5440e7f7f827fb9321b4
SHA256a07f63492b310868a2271db52fb7f33ff0df323b52c3049b15b57cf873c470d9
SHA512acd4376b667a972314e568f51c87f64551c3a21f10485bad309c0618cd126194a1bd2208a5ff67e44e0ef0ffdd459761f034d6bec28112f1c71945d810d3444b
-
memory/1080-71-0x0000000000000000-mapping.dmp
-
memory/1104-78-0x0000000000000000-mapping.dmp
-
memory/1104-82-0x000000000059D000-0x00000000005B2000-memory.dmpFilesize
84KB
-
memory/1452-56-0x000000000050D000-0x0000000000523000-memory.dmpFilesize
88KB
-
memory/1644-70-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1644-104-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-63-0x00000000004085D0-mapping.dmp
-
memory/1644-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1644-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1648-73-0x0000000000000000-mapping.dmp
-
memory/1816-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1816-110-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1816-90-0x00000000004085D0-mapping.dmp
-
memory/1820-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-100-0x0000000000476940-mapping.dmp
-
memory/1820-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-109-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-111-0x00000000747B1000-0x00000000747B3000-memory.dmpFilesize
8KB
-
memory/1820-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1820-97-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB