Analysis
-
max time kernel
179s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe
Resource
win10v2004-20220812-en
General
-
Target
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe
-
Size
208KB
-
MD5
3a8774927971752855530c6fc4721490
-
SHA1
4035438ce0143cbc82d2e67e0af8f83239439726
-
SHA256
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4
-
SHA512
441450eb86a786ce8710c2710fe6b3d3453812c11ae4b84cb7c420ac075cdef33834f06736790992c33a4082edf2ca27daba09d94a2cb67b7556d8501e36b36b
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1852 svhust.exe 672 svhust.exe 924 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1144-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1144-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1144-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1144-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1144-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1144-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/924-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/924-97-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/924-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1144-103-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/924-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/924-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/924-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/672-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/924-112-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/672-114-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exepid process 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svhust.exereg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exesvhust.exedescription pid process target process PID 2044 set thread context of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 1852 set thread context of 672 1852 svhust.exe svhust.exe PID 1852 set thread context of 924 1852 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe Token: SeDebugPrivilege 672 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 924 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exesvhust.exesvhust.exepid process 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 1852 svhust.exe 672 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.execmd.exesvhust.exedescription pid process target process PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 2044 wrote to memory of 1144 2044 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe PID 1144 wrote to memory of 1400 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe cmd.exe PID 1144 wrote to memory of 1400 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe cmd.exe PID 1144 wrote to memory of 1400 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe cmd.exe PID 1144 wrote to memory of 1400 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe cmd.exe PID 1400 wrote to memory of 1564 1400 cmd.exe reg.exe PID 1400 wrote to memory of 1564 1400 cmd.exe reg.exe PID 1400 wrote to memory of 1564 1400 cmd.exe reg.exe PID 1400 wrote to memory of 1564 1400 cmd.exe reg.exe PID 1144 wrote to memory of 1852 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe svhust.exe PID 1144 wrote to memory of 1852 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe svhust.exe PID 1144 wrote to memory of 1852 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe svhust.exe PID 1144 wrote to memory of 1852 1144 445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 672 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe PID 1852 wrote to memory of 924 1852 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe"C:\Users\Admin\AppData\Local\Temp\445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe"C:\Users\Admin\AppData\Local\Temp\445d65acf59293f0881f4ca9632c28b29015cb2b2d6477dee7c36f0de7021fe4.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SOCOW.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SOCOW.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD57e83b8c233d000447915f8f2cf5dc7c9
SHA1913f03da5c2df4af65c7ba848a22967f6aa4fda8
SHA25653833f2d6782a2cb673bcb0f61c6db0f031d580663399d3936a19292faad02de
SHA512025ec86146584695c54a19dcacf7993de7dfb94d19609a9c36fbe7cf9c22147dac387d42ba685b4d89dd640b9c924e7353857c34edf3743581c49750935122a3
-
memory/672-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/672-90-0x00000000004085D0-mapping.dmp
-
memory/672-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/924-109-0x0000000074B11000-0x0000000074B13000-memory.dmpFilesize
8KB
-
memory/924-97-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-100-0x0000000000476940-mapping.dmp
-
memory/924-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/924-112-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1144-70-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/1144-63-0x00000000004085D0-mapping.dmp
-
memory/1144-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-103-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1144-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1400-71-0x0000000000000000-mapping.dmp
-
memory/1564-73-0x0000000000000000-mapping.dmp
-
memory/1852-82-0x00000000008DD000-0x00000000008F2000-memory.dmpFilesize
84KB
-
memory/1852-78-0x0000000000000000-mapping.dmp
-
memory/2044-56-0x00000000002ED000-0x0000000000303000-memory.dmpFilesize
88KB