Analysis
-
max time kernel
86s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:33
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1312-66-0x00000000064D0000-0x0000000006870000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 8 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 952 voiceadequovl.exe 1312 voiceadequovl.exe 592 voiceadequovl.exe 1668 voiceadequovl.exe 632 voiceadequovl.exe 1980 voiceadequovl.exe 1392 voiceadequovl.exe 524 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 952 voiceadequovl.exe 952 voiceadequovl.exe 952 voiceadequovl.exe 952 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exevoiceadequovl.exepowershell.exepid process 1196 powershell.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 1312 voiceadequovl.exe 996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1312 voiceadequovl.exe Token: SeDebugPrivilege 1196 powershell.exe Token: SeDebugPrivilege 996 powershell.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exedescription pid process target process PID 1728 wrote to memory of 952 1728 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1728 wrote to memory of 952 1728 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1728 wrote to memory of 952 1728 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1728 wrote to memory of 952 1728 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 952 wrote to memory of 1312 952 voiceadequovl.exe voiceadequovl.exe PID 952 wrote to memory of 1312 952 voiceadequovl.exe voiceadequovl.exe PID 952 wrote to memory of 1312 952 voiceadequovl.exe voiceadequovl.exe PID 952 wrote to memory of 1312 952 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1196 1312 voiceadequovl.exe powershell.exe PID 1312 wrote to memory of 1196 1312 voiceadequovl.exe powershell.exe PID 1312 wrote to memory of 1196 1312 voiceadequovl.exe powershell.exe PID 1312 wrote to memory of 1196 1312 voiceadequovl.exe powershell.exe PID 1312 wrote to memory of 1852 1312 voiceadequovl.exe cmd.exe PID 1312 wrote to memory of 1852 1312 voiceadequovl.exe cmd.exe PID 1312 wrote to memory of 1852 1312 voiceadequovl.exe cmd.exe PID 1312 wrote to memory of 1852 1312 voiceadequovl.exe cmd.exe PID 1852 wrote to memory of 996 1852 cmd.exe powershell.exe PID 1852 wrote to memory of 996 1852 cmd.exe powershell.exe PID 1852 wrote to memory of 996 1852 cmd.exe powershell.exe PID 1852 wrote to memory of 996 1852 cmd.exe powershell.exe PID 1312 wrote to memory of 592 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 592 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 592 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 592 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1668 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1668 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1668 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1668 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 632 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 632 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 632 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 632 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1980 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1980 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1980 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1980 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 524 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 524 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 524 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 524 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1392 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1392 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1392 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 1392 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 872 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 872 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 872 1312 voiceadequovl.exe voiceadequovl.exe PID 1312 wrote to memory of 872 1312 voiceadequovl.exe voiceadequovl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
286.9MB
MD560ce69fc83365dcf75fd3fef57e1b727
SHA16a3c51f8f2c67056109c01625562575a146ad21d
SHA2562cb1af41aeb2acb9ca635ebdbbfcc6caea4dc7bc1f24f7bca0ccada1850309a2
SHA512fb70b631224043a097e032d2ce9a3a96ad0bcb1d283b8b53c9a0161dbb9f84ec05f06da705602a3f7bfc0e74ee2467dcd11ba249306411ac7df067613dae5cea
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
283.8MB
MD5f5f1d72788a9140475f943309dd6d5e4
SHA1805af08224cd8b4dd0e1a7fe59419a7b1d7f07c8
SHA256e0f2f2867d117b5bcc3f63cb700ae96eccf90be1ffe7a42614023981d52c4a17
SHA5120e689ecdd6397424f5d43031ce057e1f1f31b4c1b3e5b234335f311c3e89ad749105bbf247b189107d9e4d784a552b2baef6813ffb20b3d9632e188e47968a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55a20766aa2701109963a37b0cd8a0c45
SHA1a2d88ec91b1cf444d488547626f1af4e6f8a99f4
SHA256af878b2702384f8401e1e9cbfb574a05eaa9be649c59bcf5e4a675ad0199b626
SHA5120c90cf3cecbffc315e191427ac4468647d0f3c34ac32eee3206fb72ed6401a997bf2ebe3597c4f3a323f54e19ce2e4d6924d007e4068ae16e4f5d150969b3af0
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
189.1MB
MD5507d618a86d89a02b040182c5bc9342c
SHA124d84110fe6dd3767d9fce4cca5e3d566c324f97
SHA2569d3691114a97c0a29819e7da05cffaddce07387c4c1f7fd9d04a428955bb4e31
SHA5126a38be454356b712bb143afbd7bd9c214dc41266e717bfb418dcdf9a5f6937840804f180a9d08c921ac6b85a509a77d0898ccab400aa4e077c01b6f435c34b3d
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
174.2MB
MD549fbffff141834be4bddc71a4e953fdc
SHA14350f25a05b77bc3f2ac1a2ccc91aff9a7182e9f
SHA256306ab48ae58eb9fe8dd8afd5bc4bb23520e414ebb054bbd9956ade784eddd298
SHA51236205020ed0b4a6dc7fa5896542ca18f6a87fbf8346d4392ea03efc56d7589dcee255bd5c922920311d06e53486719a56ebfa833b746442799345d78680ed05f
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
56.6MB
MD513f18bbe7b2165d7e344b0872aca4b9f
SHA1fa0b72acdedeb31605b6c40b4d7abbceef56a446
SHA2560da7ca9168fb1cf7e39ff12040d71f68e7739d0961137da0b4e9fec05e10521e
SHA512f0663c811a2a8ec0dd2d05e80f041c07c4085d2841e98f46cbcf4d0dbda4fc1781f7e3bfc8acd366e012db5c75f2c6f06c3bbbd8dffce1c73e71e305e5c21f05
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
56.7MB
MD5643cf7240942bc023af792411056cebf
SHA18ebebdecccff5d2bf2d5f3c2ace3ba237e8aacb0
SHA256856401329af80af877e94ec026e9f15b9e2edec4fa528cb7cb1e4880315a5dd5
SHA512c886300d8079872213549ba014a591a9f979ca3d359cb503cf1b0b38cf701abcd5cc856577bbe7191d48e2ae1ca42bfe5bc9f6852ba9df3fcb12483bbea324c0
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
55.9MB
MD55e5eb5f7da1d5cf928a1043771faadbf
SHA12a78eb58041ac3b4d74f85f988771eecd4a98ed2
SHA2561540c0a54d33807a15fac41a27f68b45213b28093733e400b25bf616e7386133
SHA5121d9fcfd3e4f98f4ecd3f600beb06add7bfa0cd30c407dce2ec820836a85da0adc803bda9de8a6739f45a309d7f3b58dacf7990a3004b7a1fefa7b3d6588b9a66
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
55.5MB
MD5f253306e14932da8cdc629c432fd741b
SHA1440b65c5d8310c1ed4b1ba76ed365c2eb39f9262
SHA2567b592f752786faaf172665483a7767c0dfbbd3004e2e481c4704a5c63735326b
SHA512d83ad361933065c8466d19cb2f3982b99570eb1f25272df440460af3e7a6975b392f3ab73e91a89706bec8ec6c1de467be1464fa73ad868b4747e9d722e6dae2
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
55.3MB
MD5c5a17458c54d4c86696d749a150a8026
SHA131276bda5ae97f09f1b5eafefddc942bfb5bb463
SHA25614f3f66c43deffede31bdb214e06517c19a48be2711143815428d45fd81fe5b2
SHA51270e129426b1b04e791137a87b88393a7f8e4d794d39511c57573c26eba39d9e79a4d14f40d2f704f2d602d3a982e943f308c6d46090c44164d01896d02226f37
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
55.3MB
MD5c5a17458c54d4c86696d749a150a8026
SHA131276bda5ae97f09f1b5eafefddc942bfb5bb463
SHA25614f3f66c43deffede31bdb214e06517c19a48be2711143815428d45fd81fe5b2
SHA51270e129426b1b04e791137a87b88393a7f8e4d794d39511c57573c26eba39d9e79a4d14f40d2f704f2d602d3a982e943f308c6d46090c44164d01896d02226f37
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
54.8MB
MD54f627fc5c7710fa75132b25ad613ecb0
SHA1bd690529c8fb5f508970c9a1059b0b57ecf39ef4
SHA2560929e1d7e1c1998d6a76511c2a61e88bde6071c123fae6d16dfbe751476cb3e7
SHA512e49212d68711e43f7dfa83f0251e61875a220a37c6337724c3dfcd93646e5a45e23758380065b655efe7500d264693b444061c14024b7943a083a577feeb06ef
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
42.6MB
MD54f35c0d0a3c25d5d1418dd919618494c
SHA1df608fa4563790e926576aa66f2d173d611a2775
SHA2567f71614346999a99b84ff9f2430c9ee7cac59f0aba724bb9f186b5e6f2ff3492
SHA51202aa5fdb2282175f06a1f1ecc8e8a2dfe13631366f0f8618af49658d05c8189f9030af4725afb37eab1db6843646c418ab2567d7b051877f96d083d5f4a029d4
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
55.3MB
MD5c5a17458c54d4c86696d749a150a8026
SHA131276bda5ae97f09f1b5eafefddc942bfb5bb463
SHA25614f3f66c43deffede31bdb214e06517c19a48be2711143815428d45fd81fe5b2
SHA51270e129426b1b04e791137a87b88393a7f8e4d794d39511c57573c26eba39d9e79a4d14f40d2f704f2d602d3a982e943f308c6d46090c44164d01896d02226f37
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
40.4MB
MD5eb00da285839072ef5a6160eb8428884
SHA16b056fedd14a05a37139974799396361c9bb41ea
SHA2563e59b955efcc34b94def0ef44ad22d59bd60086da5bdc3396002c08a8a4b1814
SHA512c68a1939d29125523516cc6e91e28dde08d40717520b7d92251921eefd188e61e025fbd887a701590efe7506cb77da503f7e3d60c16f365ceb04f8a51fedc966
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
194.1MB
MD5d475b6cf6be3bf7c604094cec682e704
SHA13b3b87e2878e1d7fbd1d31203f4d14b67377ff6d
SHA25627866f5184a5dbb08d452bdfff5d87405ba73658dfa3ab3fa4ee1b5c013b948f
SHA5124e6a8648bae10d3c5935abb112deb26cd1d5c3956807a202ec5f804e4322f46a8ee35400d5e9e6d8f0052460050f08f66df96d2a6de9bb835648d9a329e148fe
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
173.2MB
MD53c82a2c874ddb75e2a45b0cf373221d5
SHA18d1006f5ff6dc1ed07a8beba5ea7c6191cff205c
SHA2569bf0074f9521a7cc173ef281dacf02536351325215e4081fbec85b179a0dd0dd
SHA51229b8ca39cbd60044b622b5bccb90a19394d87c75ce36d079b81a67e06ca12031c99e2a3a558fc0388f953c9fc908f8b940e91591f74f311cebd305ef7735a52d
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
189.8MB
MD5ce179c2a45984e7dc1edda9dbf250274
SHA15e0d82729c4508c172997141436ebb86582a7e51
SHA256a5c15078530cea94fc2b835fa486094f38e04035c1a380a0800e0b1f9e7431e4
SHA5125c25326fced5d29651721e01ac678357131cc98d33d5bdb4b14a5dc4ff89baa0d068c29a305ed0517b90325ae0b4e86c9626abf5864fd9f65319c1eee2f5783c
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
187.9MB
MD58600fd1288dda16a120cb27366c353e4
SHA1ca7d2da689261b9f1e238929766665f9fc4cef5d
SHA25675b99b5d6dff7c4b103a32153e30af45b6675ab26d58dd5530168d9c9bb14084
SHA51261fc2b284b6afd3c2e5077b741d43ce4189fc980c5555a3eb7c46cea7548af8631a617e8fb9b37f17647da926b5b06ccf5979feb067fb71cbf17f95ef1efb36f
-
memory/952-54-0x0000000000000000-mapping.dmp
-
memory/952-56-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/996-87-0x000000006F2F0000-0x000000006F89B000-memory.dmpFilesize
5.7MB
-
memory/996-74-0x0000000000000000-mapping.dmp
-
memory/1196-71-0x000000006F5A0000-0x000000006FB4B000-memory.dmpFilesize
5.7MB
-
memory/1196-70-0x000000006F5A0000-0x000000006FB4B000-memory.dmpFilesize
5.7MB
-
memory/1196-69-0x000000006F5A0000-0x000000006FB4B000-memory.dmpFilesize
5.7MB
-
memory/1196-67-0x0000000000000000-mapping.dmp
-
memory/1312-73-0x00000000053A0000-0x0000000005512000-memory.dmpFilesize
1.4MB
-
memory/1312-66-0x00000000064D0000-0x0000000006870000-memory.dmpFilesize
3.6MB
-
memory/1312-65-0x0000000000320000-0x0000000000A94000-memory.dmpFilesize
7.5MB
-
memory/1312-62-0x0000000000000000-mapping.dmp
-
memory/1852-72-0x0000000000000000-mapping.dmp