Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-02-2023 16:10
Behavioral task
behavioral1
Sample
PerX.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
PerX.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Scarletz.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Scarletz.dll
Resource
win10v2004-20220812-en
General
-
Target
PerX.exe
-
Size
700KB
-
MD5
2a1a572771597d924ed145efaf4c77d6
-
SHA1
0302a5986fadc56557018291003a2bc852fd0913
-
SHA256
333ea334c1a637d1ef888771bf6542953d28f76c26487356ff2a94a971667c55
-
SHA512
17560878ae608fe947220f0d640d72d51e7c607e238e8be7b9f19fc7d20a7dd631633c21f424629bb8f57963161d8226601308cf95ced86c7c178b64dd0302fc
-
SSDEEP
12288:Ddm3xc4L24cmoS8c97WyggbpPYfBZpLnPO2Vmi1ZXA2m/jl+mixj2:Ddm3xX9ggbpcLP7A2gomOC
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
PerX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" PerX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" PerX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" PerX.exe -
Processes:
PerX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PerX.exe -
Processes:
PerX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" PerX.exe -
Executes dropped EXE 1 IoCs
Processes:
PerXmgr.exepid process 1704 PerXmgr.exe -
Loads dropped DLL 9 IoCs
Processes:
PerX.exeWerFault.exepid process 1996 PerX.exe 1996 PerX.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe -
Processes:
resource yara_rule behavioral1/memory/1996-60-0x0000000001EE0000-0x0000000002F6E000-memory.dmp upx behavioral1/memory/1996-68-0x0000000000400000-0x0000000000531000-memory.dmp upx behavioral1/memory/1996-70-0x0000000001EE0000-0x0000000002F6E000-memory.dmp upx behavioral1/memory/1996-77-0x0000000000400000-0x0000000000531000-memory.dmp upx behavioral1/memory/1996-78-0x0000000001EE0000-0x0000000002F6E000-memory.dmp upx behavioral1/memory/1704-80-0x00000000002C0000-0x000000000031B000-memory.dmp upx -
Processes:
PerX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" PerX.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" PerX.exe -
Processes:
PerX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PerX.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
PerX.exedescription ioc process File opened (read-only) \??\J: PerX.exe File opened (read-only) \??\L: PerX.exe File opened (read-only) \??\O: PerX.exe File opened (read-only) \??\P: PerX.exe File opened (read-only) \??\Z: PerX.exe File opened (read-only) \??\H: PerX.exe File opened (read-only) \??\I: PerX.exe File opened (read-only) \??\R: PerX.exe File opened (read-only) \??\S: PerX.exe File opened (read-only) \??\U: PerX.exe File opened (read-only) \??\V: PerX.exe File opened (read-only) \??\X: PerX.exe File opened (read-only) \??\F: PerX.exe File opened (read-only) \??\N: PerX.exe File opened (read-only) \??\K: PerX.exe File opened (read-only) \??\Q: PerX.exe File opened (read-only) \??\W: PerX.exe File opened (read-only) \??\Y: PerX.exe File opened (read-only) \??\E: PerX.exe File opened (read-only) \??\G: PerX.exe File opened (read-only) \??\M: PerX.exe File opened (read-only) \??\T: PerX.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
PerX.exedescription ioc process File opened for modification C:\autorun.inf PerX.exe -
Drops file in Program Files directory 5 IoCs
Processes:
PerX.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe PerX.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe PerX.exe -
Drops file in Windows directory 1 IoCs
Processes:
PerX.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI PerX.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1112 1704 WerFault.exe PerXmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
PerX.exeWerFault.exepid process 1996 PerX.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1112 WerFault.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe 1996 PerX.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1112 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
PerX.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1996 PerX.exe Token: SeDebugPrivilege 1112 WerFault.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
PerX.exePerXmgr.exedescription pid process target process PID 1996 wrote to memory of 1704 1996 PerX.exe PerXmgr.exe PID 1996 wrote to memory of 1704 1996 PerX.exe PerXmgr.exe PID 1996 wrote to memory of 1704 1996 PerX.exe PerXmgr.exe PID 1996 wrote to memory of 1704 1996 PerX.exe PerXmgr.exe PID 1704 wrote to memory of 1112 1704 PerXmgr.exe WerFault.exe PID 1704 wrote to memory of 1112 1704 PerXmgr.exe WerFault.exe PID 1704 wrote to memory of 1112 1704 PerXmgr.exe WerFault.exe PID 1704 wrote to memory of 1112 1704 PerXmgr.exe WerFault.exe PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1704 1996 PerX.exe PerXmgr.exe PID 1996 wrote to memory of 1704 1996 PerX.exe PerXmgr.exe PID 1996 wrote to memory of 1112 1996 PerX.exe WerFault.exe PID 1996 wrote to memory of 1112 1996 PerX.exe WerFault.exe PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1112 1996 PerX.exe WerFault.exe PID 1996 wrote to memory of 1112 1996 PerX.exe WerFault.exe PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE PID 1996 wrote to memory of 1124 1996 PerX.exe taskhost.exe PID 1996 wrote to memory of 1212 1996 PerX.exe Dwm.exe PID 1996 wrote to memory of 1248 1996 PerX.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
PerX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PerX.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\PerX.exe"C:\Users\Admin\AppData\Local\Temp\PerX.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\PerXmgr.exeC:\Users\Admin\AppData\Local\Temp\PerXmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 1524⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
C:\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
\Users\Admin\AppData\Local\Temp\PerXmgr.exeFilesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
memory/1112-75-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/1112-61-0x0000000000000000-mapping.dmp
-
memory/1112-81-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/1112-76-0x0000000000430000-0x0000000000481000-memory.dmpFilesize
324KB
-
memory/1704-57-0x0000000000000000-mapping.dmp
-
memory/1704-72-0x00000000002C0000-0x000000000031B000-memory.dmpFilesize
364KB
-
memory/1704-80-0x00000000002C0000-0x000000000031B000-memory.dmpFilesize
364KB
-
memory/1996-60-0x0000000001EE0000-0x0000000002F6E000-memory.dmpFilesize
16.6MB
-
memory/1996-54-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1996-71-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/1996-70-0x0000000001EE0000-0x0000000002F6E000-memory.dmpFilesize
16.6MB
-
memory/1996-77-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/1996-78-0x0000000001EE0000-0x0000000002F6E000-memory.dmpFilesize
16.6MB
-
memory/1996-79-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/1996-68-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB