Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-03-2023 22:29
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe
Resource
win7-20230220-en
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe
-
Size
3.8MB
-
MD5
86000b0a976dc4a377b2e5192fe30445
-
SHA1
ad29b138883d7906f8d6e75f2e5f60e5285d4a56
-
SHA256
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
-
SHA512
4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
SSDEEP
98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
wbnh.exewbnh.exewbnh.exewbnh.exepid process 1148 wbnh.exe 920 wbnh.exe 608 wbnh.exe 1968 wbnh.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exewbnh.exewbnh.exepid process 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 920 wbnh.exe 1968 wbnh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exewbnh.exewbnh.exedescription pid process target process PID 1808 set thread context of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1148 set thread context of 920 1148 wbnh.exe wbnh.exe PID 608 set thread context of 1968 608 wbnh.exe wbnh.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 268 schtasks.exe 1988 schtasks.exe 1256 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exewbnh.exewbnh.exedescription pid process Token: SeDebugPrivilege 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe Token: SeShutdownPrivilege 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe Token: SeDebugPrivilege 920 wbnh.exe Token: SeShutdownPrivilege 920 wbnh.exe Token: SeDebugPrivilege 1968 wbnh.exe Token: SeShutdownPrivilege 1968 wbnh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.exepid process 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe 2012 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.28471.2091.execmd.exetaskeng.exewbnh.execmd.exedescription pid process target process PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 2012 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe PID 1808 wrote to memory of 1980 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 1980 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 1980 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 1980 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 776 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 776 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 776 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 776 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 540 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 540 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 540 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 1808 wrote to memory of 540 1808 SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe cmd.exe PID 776 wrote to memory of 268 776 cmd.exe schtasks.exe PID 776 wrote to memory of 268 776 cmd.exe schtasks.exe PID 776 wrote to memory of 268 776 cmd.exe schtasks.exe PID 776 wrote to memory of 268 776 cmd.exe schtasks.exe PID 1152 wrote to memory of 1148 1152 taskeng.exe wbnh.exe PID 1152 wrote to memory of 1148 1152 taskeng.exe wbnh.exe PID 1152 wrote to memory of 1148 1152 taskeng.exe wbnh.exe PID 1152 wrote to memory of 1148 1152 taskeng.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 920 1148 wbnh.exe wbnh.exe PID 1148 wrote to memory of 2028 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 2028 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 2028 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 2028 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1976 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1976 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1976 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1976 1148 wbnh.exe cmd.exe PID 1976 wrote to memory of 1988 1976 cmd.exe schtasks.exe PID 1976 wrote to memory of 1988 1976 cmd.exe schtasks.exe PID 1976 wrote to memory of 1988 1976 cmd.exe schtasks.exe PID 1976 wrote to memory of 1988 1976 cmd.exe schtasks.exe PID 1148 wrote to memory of 1104 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1104 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1104 1148 wbnh.exe cmd.exe PID 1148 wrote to memory of 1104 1148 wbnh.exe cmd.exe PID 1152 wrote to memory of 608 1152 taskeng.exe wbnh.exe PID 1152 wrote to memory of 608 1152 taskeng.exe wbnh.exe PID 1152 wrote to memory of 608 1152 taskeng.exe wbnh.exe PID 1152 wrote to memory of 608 1152 taskeng.exe wbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.28471.2091.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {3E232EA8-CEF7-4FF6-9922-674E9BEE4982} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
memory/608-156-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB
-
memory/608-151-0x00000000012C0000-0x0000000001696000-memory.dmpFilesize
3.8MB
-
memory/920-131-0x0000000000440000-0x000000000080E000-memory.dmpFilesize
3.8MB
-
memory/920-130-0x0000000000440000-0x000000000080E000-memory.dmpFilesize
3.8MB
-
memory/920-126-0x0000000000440000-0x000000000080E000-memory.dmpFilesize
3.8MB
-
memory/920-122-0x0000000000440000-0x000000000080E000-memory.dmpFilesize
3.8MB
-
memory/920-115-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1148-129-0x0000000000550000-0x0000000000590000-memory.dmpFilesize
256KB
-
memory/1148-107-0x00000000012C0000-0x0000000001696000-memory.dmpFilesize
3.8MB
-
memory/1808-54-0x0000000000CB0000-0x0000000001086000-memory.dmpFilesize
3.8MB
-
memory/1808-55-0x0000000000BA0000-0x0000000000BE0000-memory.dmpFilesize
256KB
-
memory/1968-167-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1968-170-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-72-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-99-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-78-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-79-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-80-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/2012-81-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/2012-82-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-83-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-85-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-86-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-87-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-89-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-90-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-91-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-94-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-93-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-95-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/2012-96-0x0000000000100000-0x000000000010A000-memory.dmpFilesize
40KB
-
memory/2012-97-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-77-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-101-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-103-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-76-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-75-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-74-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-73-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-71-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-69-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-66-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-127-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-64-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2012-62-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-61-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-60-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-58-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-57-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-56-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB