Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe
Resource
win10v2004-20221111-en
General
-
Target
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe
-
Size
208KB
-
MD5
1cfb5b010240ddc49499e1e66ebad500
-
SHA1
7d31af474970121af98c3bd3249e529a61db124c
-
SHA256
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf
-
SHA512
88a7ffc672dbbbb244398a9125c0df78156f96c227ce06d111fb11b3fbf301789c88a5003f0818f26a59a7d997d788bcbf372674d4b0c81074e3183c0f2905df
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1488 svhust.exe 1036 svhust.exe 536 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1192-83-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1192-85-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1192-86-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1192-89-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1192-90-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1192-93-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/536-118-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/536-121-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/536-123-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1192-126-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/536-129-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/536-132-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/536-133-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1036-134-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/536-137-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1036-138-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exepid process 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exesvhust.exedescription pid process target process PID 1092 set thread context of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1488 set thread context of 1036 1488 svhust.exe svhust.exe PID 1488 set thread context of 536 1488 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe Token: SeDebugPrivilege 1036 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 536 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exesvhust.exesvhust.exepid process 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 1488 svhust.exe 1036 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.execmd.exesvhust.exedescription pid process target process PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1092 wrote to memory of 1192 1092 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe PID 1192 wrote to memory of 2036 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe cmd.exe PID 1192 wrote to memory of 2036 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe cmd.exe PID 1192 wrote to memory of 2036 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe cmd.exe PID 1192 wrote to memory of 2036 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe cmd.exe PID 2036 wrote to memory of 1740 2036 cmd.exe reg.exe PID 2036 wrote to memory of 1740 2036 cmd.exe reg.exe PID 2036 wrote to memory of 1740 2036 cmd.exe reg.exe PID 2036 wrote to memory of 1740 2036 cmd.exe reg.exe PID 1192 wrote to memory of 1488 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe svhust.exe PID 1192 wrote to memory of 1488 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe svhust.exe PID 1192 wrote to memory of 1488 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe svhust.exe PID 1192 wrote to memory of 1488 1192 4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 1036 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe PID 1488 wrote to memory of 536 1488 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe"C:\Users\Admin\AppData\Local\Temp\4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe"C:\Users\Admin\AppData\Local\Temp\4774a2b96833f1a11b728e0eb12a68c127860ea23800ec960f601b5419c51caf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WTSWJ.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1740 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1036 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:536
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WTSWJ.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5baa0aec5d17d7011b2c051d026fac4c1
SHA104b7f7e4b8343eeecf264c246d1611658144933e
SHA256e03b3b551137215344fb4f0013582cc286c33c7c2e64b7b14401217671a74c87
SHA512094cde17be6d524b4288c9a084656ba7b2d7d73cfb4a8cd608501b5efed6d5e201c852c29673686784e189bb12236e8fe6419a033cc395a405ca6336ffa20589
-
memory/536-121-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-118-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-137-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-133-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-132-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-129-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-124-0x0000000000476940-mapping.dmp
-
memory/536-123-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/536-135-0x00000000741F1000-0x00000000741F3000-memory.dmpFilesize
8KB
-
memory/536-116-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1036-114-0x00000000004085D0-mapping.dmp
-
memory/1036-138-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1036-134-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-85-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-86-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-82-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-87-0x00000000004085D0-mapping.dmp
-
memory/1192-126-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-83-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-89-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-90-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-93-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1192-94-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1488-106-0x000000000051D000-0x0000000000532000-memory.dmpFilesize
84KB
-
memory/1488-102-0x0000000000000000-mapping.dmp
-
memory/1740-97-0x0000000000000000-mapping.dmp
-
memory/2036-95-0x0000000000000000-mapping.dmp