Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 06:37
Static task
static1
Behavioral task
behavioral1
Sample
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
Resource
win7-20240419-en
General
-
Target
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe
-
Size
6.9MB
-
MD5
87825d66996c3910b2fbed3f5ab4a2ee
-
SHA1
a86aa5c25645488b3a3a9aafae4779e8f9362848
-
SHA256
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287
-
SHA512
1b4bb50e745b4e296c056076daebcdfe3e59130f3a8b9991203a6449614fa34bad86e0af37d6f8c1e351ceea03f4acca318bb9ba861ea73f6724230fbf0a9ff8
-
SSDEEP
98304:Wws2ANnKXOaeOgmht8n5QBUqoDwkYRzddiHP6nIFriWp86fv0o8j49Z5/xP:kKXbeO7A8U2kQBdiHPtRT8o8sb59
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4548-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4548-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4548-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4580-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4580-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4996-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4996-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4996-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240606359.txt family_gh0strat behavioral2/memory/4548-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4548-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4548-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4580-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4580-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4996-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4996-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4996-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatfor.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
R.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240606359.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatfor.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 6 IoCs
Processes:
R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exeRemote Data.exepid process 1500 R.exe 4548 N.exe 4580 TXPlatfor.exe 4996 TXPlatfor.exe 3532 HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe 2412 Remote Data.exe -
Loads dropped DLL 3 IoCs
Processes:
R.exesvchost.exeRemote Data.exepid process 1500 R.exe 3812 svchost.exe 2412 Remote Data.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral2/memory/4548-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4548-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4548-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4548-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4580-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4580-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4580-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4996-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4996-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4996-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
R.exesvchost.exeN.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File created C:\Windows\SysWOW64\240606359.txt R.exe -
Drops file in Program Files directory 1 IoCs
Processes:
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exepid process 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatfor.exepid process 4996 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
N.exeTXPlatfor.exejavaw.exedescription pid process Token: SeIncBasePriorityPrivilege 4548 N.exe Token: SeLoadDriverPrivilege 4996 TXPlatfor.exe Token: SeRestorePrivilege 3200 javaw.exe Token: SeRestorePrivilege 3200 javaw.exe Token: 33 4996 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4996 TXPlatfor.exe Token: 33 4996 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4996 TXPlatfor.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exejavaw.exepid process 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe 3200 javaw.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exeN.exeTXPlatfor.exeHD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.execmd.exejavaw.exesvchost.exedescription pid process target process PID 2832 wrote to memory of 1500 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe R.exe PID 2832 wrote to memory of 1500 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe R.exe PID 2832 wrote to memory of 1500 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe R.exe PID 2832 wrote to memory of 4548 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe N.exe PID 2832 wrote to memory of 4548 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe N.exe PID 2832 wrote to memory of 4548 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe N.exe PID 4548 wrote to memory of 3244 4548 N.exe cmd.exe PID 4548 wrote to memory of 3244 4548 N.exe cmd.exe PID 4548 wrote to memory of 3244 4548 N.exe cmd.exe PID 4580 wrote to memory of 4996 4580 TXPlatfor.exe TXPlatfor.exe PID 4580 wrote to memory of 4996 4580 TXPlatfor.exe TXPlatfor.exe PID 4580 wrote to memory of 4996 4580 TXPlatfor.exe TXPlatfor.exe PID 2832 wrote to memory of 3532 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe PID 2832 wrote to memory of 3532 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe PID 2832 wrote to memory of 3532 2832 8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe PID 3532 wrote to memory of 3200 3532 HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe javaw.exe PID 3532 wrote to memory of 3200 3532 HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe javaw.exe PID 3244 wrote to memory of 4516 3244 cmd.exe PING.EXE PID 3244 wrote to memory of 4516 3244 cmd.exe PING.EXE PID 3244 wrote to memory of 4516 3244 cmd.exe PING.EXE PID 3200 wrote to memory of 2520 3200 javaw.exe icacls.exe PID 3200 wrote to memory of 2520 3200 javaw.exe icacls.exe PID 3200 wrote to memory of 1064 3200 javaw.exe cmd.exe PID 3200 wrote to memory of 1064 3200 javaw.exe cmd.exe PID 3812 wrote to memory of 2412 3812 svchost.exe Remote Data.exe PID 3812 wrote to memory of 2412 3812 svchost.exe Remote Data.exe PID 3812 wrote to memory of 2412 3812 svchost.exe Remote Data.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"C:\Users\Admin\AppData\Local\Temp\8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exeC:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Program Files\Java\jdk-1.8\bin\javaw.exe"C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M4⤵
- Modifies file permissions
PID:2520 -
C:\Windows\SYSTEM32\cmd.execmd ver4⤵PID:1064
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:820
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240606359.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestampFilesize
50B
MD5743dd63743c5c0261fe8270af305e511
SHA1855b4592ae7a74d42c26d241e87b6680b3928771
SHA256c76503321dabc5d0ad37221c3c9889955817c7ff3b4a9217919c99f1f8556851
SHA51259f2a7461c8878fdfb9e468d81d92cd57be45f1fcc1ad40a153630c18d44713d6db9e741e782a1ce2eddf30ec41e8f692721a1dd2a769597faebcc90e50fd91d
-
C:\Users\Admin\AppData\Local\Temp\HD_8b0932899a0cb3350905b12d4e6e2af39c7edd79871eae46e949874279426287.exeFilesize
4.4MB
MD5c40aebee2bf4002f042241a4625176d4
SHA13bfb5be63e2438788e431440865cb0dc42f34ef7
SHA2568e4f917471e96a7f28802a0e816d000aa7156a040a066887672207ca9cb6474e
SHA5126fabce39177305db58cc95bd7ffac3bf4348c738c158e0c420e1d9bef7020ec81512ddf1d4accceb324bd0127b7d611ae316b418340db465b4ca925c90eaaa3f
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
2.5MB
MD5171a226dee5aaa5d81a1fdaf619b2d5e
SHA104de24f275712462e48764824527ee85c423fa6e
SHA2568ab75d2cf26d6147f3385edf5959a41bc18cd45b14bdc04f3fbe1faa1d23912d
SHA512a0420bffaa224ac4266fd5850c9c002fc2d1cb9f7fa8e32860028a5cf175ae84065f2a913038a996c59ba83181df31514ec0df6f18848cf440cfe2f929a7219c
-
C:\Users\Admin\AppData\Local\Temp\N.exeFilesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
C:\Users\Admin\AppData\Local\Temp\R.exeFilesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
C:\Users\Admin\AppData\Local\Temp\hmcl.jsonFilesize
818B
MD590f35d77c9f7d8124cd12986f0528712
SHA111c4527f1d33cd7383f50c2128a3812166658cea
SHA256f08afba233387e4f273149c4990f60cd1642e67c68477a2081f41d2b764be425
SHA512fb18aa3e57839db7e66eb2b4ce31f63ec51063a98d729d7639e956ea263e878ed6357a5fc3493bb5d02de2fb095e4fa9d3e3798e6d8362232a089df113080ade
-
C:\Users\Admin\AppData\Local\Temp\hmcl.jsonFilesize
817B
MD5d4084216850a615b37ebd35eb2b8d155
SHA1fdb87602b59bfa2ccd5617d0ae8d4a57ffe560eb
SHA25682fdcc3b988db5a376701810b0ba203185d4624b1b647fbae44479ca1b57f6df
SHA5126bf57587dc647a0ac2703020517aa7c86152384600bb1bef0d2ce138b88987dcf3e026768bc310883d05b9a375678630ab48f2379ea645eaf2ac72d17cf93853
-
C:\Users\Admin\AppData\Local\Temp\hmcl.jsonFilesize
824B
MD5c458dfec4fef766b6879ff1ad3e0c340
SHA13aec48fc6b28ce16460a443acc855b643fc76d35
SHA256b37784c2082b7adb63a2beab81f842fd5c016706663234b179d1f5c9a4623032
SHA51254334b08df55df78cd84cf43f0c14b999822c9489cf8a591327cb48cf0a911194ce80567bd663e117c9a667aac606a12771182105c4560573ec1d45054eaa6da
-
C:\Users\Admin\AppData\Roaming\.hmcl\authlib-injector.jarFilesize
333KB
MD5c60d3899b711537e10be33c680ebd8ae
SHA11eca6aa7faf7ac6e3211862afa6e43fe2eedd07b
SHA2563bc9ebdc583b36abd2a65b626c4b9f35f21177fbf42a851606eaaea3fd42ee0f
SHA5125b0634bdd4193e9d5423b4e0490b980132081df0a845d3832031c8be637d93616aee82bbaeb427fb6f617aeeb381e7246ee5e83a79bde071ef0b02a81cb91289
-
C:\Windows\SysWOW64\240606359.txtFilesize
899KB
MD5abbff166b925b71e16e2f02236946cfb
SHA1a36cccb5fcf54c8d94a0f86f76e8597e8a255f5f
SHA256b0fe8eee6dcb4e576fb4e0970b0d9a029211c8a72c33b80e12185a79d97d8274
SHA512513b5c4c24d27446a6faef3b61e984d62b9a5123092180e2cd2a6cab75079febf2c93e6ff2b64d1c7c3acebcded1259ca9035eae795e32375a0d02d884350af9
-
C:\Windows\SysWOW64\Remote Data.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/3200-175-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-207-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-245-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-243-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-242-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-69-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-71-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-79-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-111-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-226-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-212-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-209-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-152-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/3200-204-0x0000020D36580000-0x0000020D36581000-memory.dmpFilesize
4KB
-
memory/4548-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4548-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4548-23-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4548-20-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4580-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4580-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4580-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4996-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4996-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4996-41-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB