Analysis
-
max time kernel
194s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe
Resource
win10v2004-20220812-en
General
-
Target
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe
-
Size
208KB
-
MD5
b92fe9424a59826e83cbeb087c851460
-
SHA1
af6c9e4a8951ac4e167649ec1568bbce81afba72
-
SHA256
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd
-
SHA512
226ee2085a391ee0f6365029e962dc7326be4056723e9b6e9b513ebe68101e57a4dd74d1c7ac37c981eeadc9da65621f7d56aea838b6806330ab0bdc434cdf74
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1548 svhust.exe 1496 svhust.exe 112 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1156-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1156-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1156-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1156-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1156-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1156-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/112-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/112-97-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/112-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/112-106-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1156-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/112-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/112-109-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1496-110-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/112-113-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1496-114-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exepid process 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exesvhust.exedescription pid process target process PID 1456 set thread context of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1548 set thread context of 1496 1548 svhust.exe svhust.exe PID 1548 set thread context of 112 1548 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe Token: SeDebugPrivilege 1496 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 112 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exesvhust.exesvhust.exepid process 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 1548 svhust.exe 1496 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.execmd.exesvhust.exedescription pid process target process PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1456 wrote to memory of 1156 1456 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe PID 1156 wrote to memory of 604 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe cmd.exe PID 1156 wrote to memory of 604 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe cmd.exe PID 1156 wrote to memory of 604 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe cmd.exe PID 1156 wrote to memory of 604 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe cmd.exe PID 604 wrote to memory of 1136 604 cmd.exe reg.exe PID 604 wrote to memory of 1136 604 cmd.exe reg.exe PID 604 wrote to memory of 1136 604 cmd.exe reg.exe PID 604 wrote to memory of 1136 604 cmd.exe reg.exe PID 1156 wrote to memory of 1548 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe svhust.exe PID 1156 wrote to memory of 1548 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe svhust.exe PID 1156 wrote to memory of 1548 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe svhust.exe PID 1156 wrote to memory of 1548 1156 393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1496 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 112 1548 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe"C:\Users\Admin\AppData\Local\Temp\393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe"C:\Users\Admin\AppData\Local\Temp\393f2af422a568b21d54f4b47231b9825e54bc6a7aaf4c47728638d8993d1efd.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DRHUQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1136 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:112
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DRHUQ.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51846f37ef19d00e9e7a87ff11158a161
SHA14d1b5da4540c8ddfe93f673467581c4e051f124b
SHA256e2646199c6ae2314cbb81a6c4af7c308d2a64e03fbb8d5df5a57091e4b0f7f31
SHA5120ab8f26a40407b68914af7ece06c018e6ccb33cb0e56caa277971f05c8822c81e4f35c7780207e2f34964980e4ded8786c3b8afdcd0de6b20c57cd0ee93d2b48
-
memory/112-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-113-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-111-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/112-109-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-106-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-100-0x0000000000476940-mapping.dmp
-
memory/112-97-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/112-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/604-71-0x0000000000000000-mapping.dmp
-
memory/1136-73-0x0000000000000000-mapping.dmp
-
memory/1156-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-70-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/1156-63-0x00000000004085D0-mapping.dmp
-
memory/1156-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-107-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1456-56-0x000000000056D000-0x0000000000583000-memory.dmpFilesize
88KB
-
memory/1496-90-0x00000000004085D0-mapping.dmp
-
memory/1496-110-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1496-114-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1548-78-0x0000000000000000-mapping.dmp
-
memory/1548-82-0x000000000053D000-0x0000000000552000-memory.dmpFilesize
84KB