Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe
Resource
win10v2004-20220901-en
General
-
Target
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe
-
Size
208KB
-
MD5
de561fca38ce0a275068a0261b9702b0
-
SHA1
d592ed341633d08867594961c59c600b505f59be
-
SHA256
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9
-
SHA512
bdea9c8de7cb5131b2d0d2445f2a0381c98ea4e1b6cac3dc288ad88728c26a99b4b5aade94fa6e137dec373afaec468b2cc1729f32f9d2f23474020b1db6074c
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 884 svhust.exe 656 svhust.exe 1152 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1504-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1504-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1504-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1504-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1504-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1504-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1152-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1152-97-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1152-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1504-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1152-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1152-106-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1152-109-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/656-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/656-114-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1152-113-0x0000000000400000-0x0000000000479000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exepid process 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svhust.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exesvhust.exedescription pid process target process PID 748 set thread context of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 884 set thread context of 656 884 svhust.exe svhust.exe PID 884 set thread context of 1152 884 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe Token: SeDebugPrivilege 656 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1152 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exesvhust.exesvhust.exepid process 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 884 svhust.exe 656 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.execmd.exesvhust.exedescription pid process target process PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 748 wrote to memory of 1504 748 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe PID 1504 wrote to memory of 2008 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe cmd.exe PID 1504 wrote to memory of 2008 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe cmd.exe PID 1504 wrote to memory of 2008 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe cmd.exe PID 1504 wrote to memory of 2008 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe cmd.exe PID 2008 wrote to memory of 1716 2008 cmd.exe reg.exe PID 2008 wrote to memory of 1716 2008 cmd.exe reg.exe PID 2008 wrote to memory of 1716 2008 cmd.exe reg.exe PID 2008 wrote to memory of 1716 2008 cmd.exe reg.exe PID 1504 wrote to memory of 884 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe svhust.exe PID 1504 wrote to memory of 884 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe svhust.exe PID 1504 wrote to memory of 884 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe svhust.exe PID 1504 wrote to memory of 884 1504 57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 656 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe PID 884 wrote to memory of 1152 884 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe"C:\Users\Admin\AppData\Local\Temp\57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe"C:\Users\Admin\AppData\Local\Temp\57daeb33ce024ad1abd0d6dd3c1728284527eef8c20288c6d1de763b328068e9.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CSTQL.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1716 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:656 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1152
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CSTQL.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5f4ce281aa7c490e4875d42f2a636b646
SHA1905856c73244c8ab9e63428d11fa72bf30a43318
SHA256a7d12073f495d3cd283a035466502de0dc8a00d8689b6a8d489f74e50c160abb
SHA512bbf835fd67fcce2c8d000452159c3aa32a0ac7a60aa0fa28b4d0672b72efd0a14aec1e63b42de2c849389cd943be7bca7b6e075ad2844a1db06a3396df689813
-
memory/656-110-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/656-90-0x00000000004085D0-mapping.dmp
-
memory/656-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/748-56-0x000000000054D000-0x0000000000563000-memory.dmpFilesize
88KB
-
memory/884-82-0x000000000056D000-0x0000000000582000-memory.dmpFilesize
84KB
-
memory/884-78-0x0000000000000000-mapping.dmp
-
memory/1152-101-0x0000000000476940-mapping.dmp
-
memory/1152-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-111-0x0000000074711000-0x0000000074713000-memory.dmpFilesize
8KB
-
memory/1152-109-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-106-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-97-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1152-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1504-63-0x00000000004085D0-mapping.dmp
-
memory/1504-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1504-70-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1504-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1716-73-0x0000000000000000-mapping.dmp
-
memory/2008-71-0x0000000000000000-mapping.dmp