gh0strat | cb04f733c0a33674b5212a9d0a3ba2c893b00ca3775ea2b0e25f54a72a42a8d0

Analysis

max time kernel
1800s
max time network
1797s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
02-12-2023 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update.exe
Size

15.3MB
MD5

8c5d426590cccc0ca0f27ebed418da4e
SHA1

040ec9658021981f3e1546ee0a9dd26e2da43f04
SHA256

cfb1170c66210f82f98157c0b2ea62e5372056c6a4d36e7f0db4dc9754ef00c3
SHA512

8ec23652539776123e4af1b2f7a384bc0b88f4020b935ca90ddaa8fade239785a181d7bc6f1a9ba6884793fbf997c9f2f920aa968153e1b72f201f38b269682b
SSDEEP

393216:J79rqs77+THrAQUSA1In5Q7JNp1ruYVOgDKg:t9OsGTLBUSAin5qPv

Score

10^/10

gh0strat purplefox raccoon persistence rat rootkit stealer trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 9 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral7/memory/2496-14-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/2496-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/1788-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/1788-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/2496-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/1788-32-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/2404-38-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/2404-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral7/memory/2404-42-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 12 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\240633984.txt	family_gh0strat
behavioral7/memory/2496-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/2496-14-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/2496-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/1788-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/1788-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/1788-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/2496-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/1788-32-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/2404-38-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/2404-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral7/memory/2404-42-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

Processes:

resource	yara_rule
behavioral7/memory/2376-58-0x0000000000400000-0x0000000001809000-memory.dmp	family_raccoon_v2
behavioral7/memory/2376-57-0x0000000000400000-0x0000000001809000-memory.dmp	family_raccoon_v2
behavioral7/memory/2376-60-0x0000000000400000-0x0000000001809000-memory.dmp	family_raccoon_v2

Drops file in Drivers directory 1 IoCs

Processes:

TXPlatfor.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240633984.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 5 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_update.exe

pid process

3552 R.exe
2496 N.exe
1788 TXPlatfor.exe
2404 TXPlatfor.exe
2376 HD_update.exe
Loads dropped DLL 1 IoCs

Processes:

R.exe

pid process

3552 R.exe

pid	process
3552	R.exe
2496	N.exe
1788	TXPlatfor.exe
2404	TXPlatfor.exe
2376	HD_update.exe

pid	process
3552	R.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral7/memory/2496-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2496-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2496-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2496-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/1788-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/1788-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/1788-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/1788-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2496-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/1788-32-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2404-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2404-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral7/memory/2404-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

Processes:

R.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\240633984.txt	R.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe

Drops file in Program Files directory 1 IoCs

Processes:

update.exe

description ioc process

File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe update.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2876 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

update.exeHD_update.exe

pid process

2004 update.exe
2004 update.exe
2376 HD_update.exe
2376 HD_update.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2404 TXPlatfor.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	update.exe

pid	process
2876	PING.EXE

pid	process
2004	update.exe
2004	update.exe
2376	HD_update.exe
2376	HD_update.exe

pid	process
2404	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2496	N.exe
Token: SeLoadDriverPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe
Token: 33	2404	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2404	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

update.exe

pid process

2004 update.exe
2004 update.exe

pid	process
2004	update.exe
2004	update.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

update.exeN.exeTXPlatfor.execmd.exe

description	pid	process	target process
PID 2004 wrote to memory of 3552	2004	update.exe	R.exe
PID 2004 wrote to memory of 3552	2004	update.exe	R.exe
PID 2004 wrote to memory of 3552	2004	update.exe	R.exe
PID 2004 wrote to memory of 2496	2004	update.exe	N.exe
PID 2004 wrote to memory of 2496	2004	update.exe	N.exe
PID 2004 wrote to memory of 2496	2004	update.exe	N.exe
PID 2496 wrote to memory of 1464	2496	N.exe	cmd.exe
PID 2496 wrote to memory of 1464	2496	N.exe	cmd.exe
PID 2496 wrote to memory of 1464	2496	N.exe	cmd.exe
PID 1788 wrote to memory of 2404	1788	TXPlatfor.exe	TXPlatfor.exe
PID 1788 wrote to memory of 2404	1788	TXPlatfor.exe	TXPlatfor.exe
PID 1788 wrote to memory of 2404	1788	TXPlatfor.exe	TXPlatfor.exe
PID 2004 wrote to memory of 2376	2004	update.exe	HD_update.exe
PID 2004 wrote to memory of 2376	2004	update.exe	HD_update.exe
PID 2004 wrote to memory of 2376	2004	update.exe	HD_update.exe
PID 1464 wrote to memory of 2876	1464	cmd.exe	PING.EXE
PID 1464 wrote to memory of 2876	1464	cmd.exe	PING.EXE
PID 1464 wrote to memory of 2876	1464	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3552

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2876

C:\Users\Admin\AppData\Local\Temp\HD_update.exe
C:\Users\Admin\AppData\Local\Temp\HD_update.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2376

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:4128

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:4580

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
2.3MB

MD5
d253cedc48cee15f1e0321aca235f307

SHA1
28e169cfd0e8ebbcaafb12b744148b99d87bc281

SHA256
c7897842f7d1db6f62cd3031a00ec28f2af00dbf5ef70998ad51fce43e7e33ed

SHA512
84501cc77bd22d9484157e77751b9444d61a2af63ea8b3fa1c94f8a7c7241e6111330fe67e329fa6717e5fac946e1d5a8071429f98474b59e652f1962aba3eae

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_update.exe

Filesize
13.0MB

MD5
bcabfc8a72168c9c59967950ba586367

SHA1
4b11cde5ca21ddc2126c5dede0170f3afbeda938

SHA256
8129a2a6764c59fdfbb1945be92d8452a9a6502c6047e39c5b8d9a3c982ca192

SHA512
f756cf50bf5fffac5309de6041027947020ea65b819245c156ee92519c72d4422559981d9880808b5a34a2514942ec85d98c4ed63f4b04f2441e565003e7fac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_update.exe

Filesize
13.0MB

MD5
bcabfc8a72168c9c59967950ba586367

SHA1
4b11cde5ca21ddc2126c5dede0170f3afbeda938

SHA256
8129a2a6764c59fdfbb1945be92d8452a9a6502c6047e39c5b8d9a3c982ca192

SHA512
f756cf50bf5fffac5309de6041027947020ea65b819245c156ee92519c72d4422559981d9880808b5a34a2514942ec85d98c4ed63f4b04f2441e565003e7fac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\N.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\N.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\R.exe

Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
C:\Users\Admin\AppData\Local\Temp\R.exe

Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
C:\Windows\SysWOW64\240633984.txt

Filesize
899KB

MD5
b1fb2ef428d3e00eee8b68e7b1a7a7ee

SHA1
395c78f18ab36ad9a0019ff30c7cf975f273f040

SHA256
d41e00aa8bd169c99efa2f907f2055f89309bc6002eca9a69494ffcf09149c96

SHA512
8b5f0255084605364c66e432795c08f45e86663c098b5c74bc2ad420979c17983bace9b85a113ca14c560d8d46ac88ec536051769798fccd15c47dafce739548

Download Submit
C:\Windows\SysWOW64\TXPlatfor.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Windows\SysWOW64\TXPlatfor.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Windows\SysWOW64\TXPlatfor.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
memory/1788-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1788-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1788-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1788-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1788-32-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2376-45-0x0000000001A80000-0x0000000001A81000-memory.dmp

Filesize
4KB

Download
memory/2376-58-0x0000000000400000-0x0000000001809000-memory.dmp

Filesize
20.0MB

Download
memory/2376-57-0x0000000000400000-0x0000000001809000-memory.dmp

Filesize
20.0MB

Download
memory/2376-60-0x0000000000400000-0x0000000001809000-memory.dmp

Filesize
20.0MB

Download
memory/2404-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2404-38-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2404-42-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2496-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2496-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2496-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2496-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2496-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download