Analysis
-
max time kernel
175s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe
Resource
win10v2004-20220812-en
General
-
Target
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe
-
Size
208KB
-
MD5
a654f087963cb45cf19b591afa3b7210
-
SHA1
d74f21d1e69c0b0500e981e0269e6f9a257370af
-
SHA256
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b
-
SHA512
a46cd4424ba29908a741fc8abbc6fa68ef22a4f6852a0f01abac121174fa019169b47e772f7a6604a6b8737c7df246ef0190469c8eba7c1d5380552355b07bb0
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 628 svhust.exe 1604 svhust.exe 1052 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/888-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1052-95-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1052-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1052-100-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/888-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1052-106-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1052-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1052-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1604-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1604-113-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exepid process 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exesvhust.exedescription pid process target process PID 952 set thread context of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 628 set thread context of 1604 628 svhust.exe svhust.exe PID 628 set thread context of 1052 628 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe Token: SeDebugPrivilege 1604 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1052 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exesvhust.exesvhust.exepid process 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 628 svhust.exe 1604 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.execmd.exesvhust.exedescription pid process target process PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 952 wrote to memory of 888 952 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe PID 888 wrote to memory of 268 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe cmd.exe PID 888 wrote to memory of 268 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe cmd.exe PID 888 wrote to memory of 268 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe cmd.exe PID 888 wrote to memory of 268 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe cmd.exe PID 268 wrote to memory of 1740 268 cmd.exe reg.exe PID 268 wrote to memory of 1740 268 cmd.exe reg.exe PID 268 wrote to memory of 1740 268 cmd.exe reg.exe PID 268 wrote to memory of 1740 268 cmd.exe reg.exe PID 888 wrote to memory of 628 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe svhust.exe PID 888 wrote to memory of 628 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe svhust.exe PID 888 wrote to memory of 628 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe svhust.exe PID 888 wrote to memory of 628 888 3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1604 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe PID 628 wrote to memory of 1052 628 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe"C:\Users\Admin\AppData\Local\Temp\3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe"C:\Users\Admin\AppData\Local\Temp\3f13ea323b5b77bbabce806a7c20b8c2404e5c7ba4aa5611a92a10ac5ffe159b.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HMIIU.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1740 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1604 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1052
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HMIIU.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5bb0b5cabd19a350528932e75c72eb558
SHA1bb3581fbcd82fdeb53b6e5cb866e4566af70c6a2
SHA256a203d637d6be45666a3e4164f71129b30e49bdcfaceb78ae6f081ae749bb079a
SHA512edd5e783a84552160d0c8c46370c4855858cd7905fdd2d3677d6714dde19b2764932c17e451ce75a39b40cbcd32b117c2bdc24b5a0e13369064e6c2a21151554
-
memory/268-71-0x0000000000000000-mapping.dmp
-
memory/628-82-0x00000000002CD000-0x00000000002E2000-memory.dmpFilesize
84KB
-
memory/628-78-0x0000000000000000-mapping.dmp
-
memory/888-70-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB
-
memory/888-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-63-0x00000000004085D0-mapping.dmp
-
memory/888-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/952-56-0x000000000058D000-0x00000000005A3000-memory.dmpFilesize
88KB
-
memory/1052-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1052-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1052-100-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1052-102-0x0000000000476940-mapping.dmp
-
memory/1052-95-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1052-106-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1052-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1052-109-0x0000000074211000-0x0000000074213000-memory.dmpFilesize
8KB
-
memory/1052-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1604-90-0x00000000004085D0-mapping.dmp
-
memory/1604-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1604-113-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1740-73-0x0000000000000000-mapping.dmp