Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe
Resource
win7-20231129-en
General
-
Target
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe
-
Size
3.6MB
-
MD5
89f08f5810f9b93ad5940c5f02ca89c4
-
SHA1
cc0a64660f09322badcf1dcceaf56992719ab040
-
SHA256
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc
-
SHA512
ad753d3c72b1b4a14e0cb0ceb70351823793bb5bc3b1757ee1c9c481fa75ed9e7d37c62b6feb0e024dd700dd059e363f622a203f41cca377701dc8ab0cda879a
-
SSDEEP
49152:zQZAdVyVT9n/Gg0P+Who8JkBg/NKf/9VfZj3FV+s8KuqGaX0ToIBAUZLYo:0GdVyVT9nOgmhx2S/NU9VfZcJBAUZL3
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2208-12-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3048-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3048-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2572-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2572-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-12-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3048-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3048-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2572-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259395857.txt family_gh0strat behavioral1/memory/2572-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259395857.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2208 svchost.exe 3048 TXPlatforn.exe 2572 TXPlatforn.exe 2656 svchos.exe 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 856 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 15 IoCs
Processes:
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exeTXPlatforn.exesvchos.exesvchost.exeWerFault.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 3048 TXPlatforn.exe 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 2656 svchos.exe 1888 svchost.exe 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 2536 WerFault.exe 1888 svchost.exe 856 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2208-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2208-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3048-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3048-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2572-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2572-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchost.exesvchos.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259395857.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2536 2476 WerFault.exe HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exepid process 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2572 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2208 svchost.exe Token: SeLoadDriverPrivilege 2572 TXPlatforn.exe Token: 33 2572 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2572 TXPlatforn.exe Token: 33 2572 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2572 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exeHD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exepid process 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exesvchost.exeTXPlatforn.execmd.exeHD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exesvchost.exedescription pid process target process PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2188 wrote to memory of 2208 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchost.exe PID 2208 wrote to memory of 3008 2208 svchost.exe cmd.exe PID 2208 wrote to memory of 3008 2208 svchost.exe cmd.exe PID 2208 wrote to memory of 3008 2208 svchost.exe cmd.exe PID 2208 wrote to memory of 3008 2208 svchost.exe cmd.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 3048 wrote to memory of 2572 3048 TXPlatforn.exe TXPlatforn.exe PID 2188 wrote to memory of 2656 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchos.exe PID 2188 wrote to memory of 2656 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchos.exe PID 2188 wrote to memory of 2656 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchos.exe PID 2188 wrote to memory of 2656 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe svchos.exe PID 3008 wrote to memory of 2712 3008 cmd.exe PING.EXE PID 3008 wrote to memory of 2712 3008 cmd.exe PING.EXE PID 3008 wrote to memory of 2712 3008 cmd.exe PING.EXE PID 3008 wrote to memory of 2712 3008 cmd.exe PING.EXE PID 2188 wrote to memory of 2476 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe PID 2188 wrote to memory of 2476 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe PID 2188 wrote to memory of 2476 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe PID 2188 wrote to memory of 2476 2188 e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe PID 2476 wrote to memory of 2536 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe WerFault.exe PID 2476 wrote to memory of 2536 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe WerFault.exe PID 2476 wrote to memory of 2536 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe WerFault.exe PID 2476 wrote to memory of 2536 2476 HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe WerFault.exe PID 1888 wrote to memory of 856 1888 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1888 wrote to memory of 856 1888 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1888 wrote to memory of 856 1888 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1888 wrote to memory of 856 1888 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe"C:\Users\Admin\AppData\Local\Temp\e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exeC:\Users\Admin\AppData\Local\Temp\HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2883⤵
- Loads dropped DLL
- Program crash
PID:2536
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2488
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259395857.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5e3489f877a0dba66e0389a6af9116447
SHA1e4fe2c903c4097f3fa0d297036b537ee58f4881d
SHA2565b09b7a1f4b4c61cd6c57b6eda6c1aa839c430c08198a528927fc927c3d70ee2
SHA5120790801b7740100298778fb973e958cf8157bd09b973ba5258a2e7ab75f94faf10c0f9deb99c2a88f92c477e767b5941079d26c5159a61436d3ff6cc4b2b9a6a
-
\Users\Admin\AppData\Local\Temp\HD_e7ed2abdb90ccc8227c02c9a5675096e57edf5e9fbb4cff8f8f3c8936c1b34fc.exeFilesize
2.3MB
MD502e06b50442678ed011f9b4654c273cd
SHA1ed1e8c15722e54e62043bbfeda9249631a780168
SHA256c296e557a3d3b36144598d99025e2f1e1870399149990fba04c9453f64a6b9e0
SHA5129364600aa2cd09baf7779cce2f805c755bcd39d7474c7ea456ee7a8cb3771878bfdf3f060cb4460608502aa0736be1919ee325dde8da450a36e37d1265bf32c5
-
\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259395857.txtFilesize
50KB
MD5604b75f8a6c2bf5f301aa30d2b21132c
SHA118daa879c911c81eac85d227aaf3f57cecf56843
SHA25658dbb25531adad674d44d2b516be918f83d405a1060073d8fe1fea3261fb9136
SHA5128f0eb58b88dc05ce43bec9924fb1fd374acd911f559900345e7f2b761fb7a580a7a57073634d4b4540532dddc2679fea8e2cbe77b51cf047d6bff695b32ee837
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2208-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2208-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2572-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2572-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3048-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3048-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB