gh0strat | 76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
Size 9.3MB
Sample240625-sll3bszfpr
SHA256 76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d
MD5 e371449015725d2dda2be36b236fb2fe
SHA1 c4b171683141f0d416e3c4c6827d8355da5f1e7c
SHA512 104443aad439b9f481376184482d0453c3a01ba2a20e238c1370918b2c239e0c3594ebc806333acd5c4bb922eaaa8174ee674bfda852ea58d67d79ad5ae29ee5
SSDEEP 98304:qGdVyVT9nOgmh1sSque4rU9qaddQfs+AOncxZ96hWylIPb4mVzArOSqeDalc6d:ZWT9nO7z/qt9qaUni6Yyw44c9BDal
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1144-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1144-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1144-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/32-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/32-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3368-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3368-38-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3368-42-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3368-43-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/32-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/32-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 12 IoCs

resource	yara_rule
behavioral2/memory/1144-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1144-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1144-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/32-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/32-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3368-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/files/0x0007000000023439-36.dat	family_gh0strat
behavioral2/memory/3368-38-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3368-42-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3368-43-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/32-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/32-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240601062.txt"	svchos.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 6 IoCs

pid	Process
1144	svchost.exe
32	TXPlatforn.exe
3368	TXPlatforn.exe
3636	svchos.exe
4756	HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4280	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Loads dropped DLL 4 IoCs

pid	Process
3636	svchos.exe
656	svchost.exe
4756	HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4280	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1144-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1144-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1144-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1144-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/32-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/32-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3368-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3368-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3368-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3368-43-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/32-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/32-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/32-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File created	C:\Windows\SysWOW64\240601062.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4744	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3368	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1144	svchost.exe
Token: SeLoadDriverPrivilege	3368	TXPlatforn.exe
Token: 33	3368	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3368	TXPlatforn.exe
Token: 33	3368	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3368	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4756	HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4756	HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
4756	HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1144	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	82
PID 4360 wrote to memory of 1144	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	82
PID 4360 wrote to memory of 1144	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	82
PID 32 wrote to memory of 3368	32	TXPlatforn.exe	86
PID 32 wrote to memory of 3368	32	TXPlatforn.exe	86
PID 32 wrote to memory of 3368	32	TXPlatforn.exe	86
PID 1144 wrote to memory of 1340	1144	svchost.exe	85
PID 1144 wrote to memory of 1340	1144	svchost.exe	85
PID 1144 wrote to memory of 1340	1144	svchost.exe	85
PID 4360 wrote to memory of 3636	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	87
PID 4360 wrote to memory of 3636	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	87
PID 4360 wrote to memory of 3636	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	87
PID 1340 wrote to memory of 4744	1340	cmd.exe	91
PID 1340 wrote to memory of 4744	1340	cmd.exe	91
PID 1340 wrote to memory of 4744	1340	cmd.exe	91
PID 4360 wrote to memory of 4756	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	94
PID 4360 wrote to memory of 4756	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	94
PID 4360 wrote to memory of 4756	4360	76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe	94
PID 656 wrote to memory of 4280	656	svchost.exe	98
PID 656 wrote to memory of 4280	656	svchost.exe	98
PID 656 wrote to memory of 4280	656	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
"C:\Users\Admin\AppData\Local\Temp\76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4744
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
  C:\Users\Admin\AppData\Local\Temp\HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4756

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3368

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:1932

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240601062.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2EECore.2.7.2.dll

Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll
Size 8.4MB
SHA256 982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
MD5 8b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1 b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA512 9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
SSDEEP 98304:z0PpiCcXz5iqFaFxZkyE2kCeQ+LDSBRAN9ijNnQobT9wdxd+tNrspBAUZLh7ZV/T:QyDBaFxZNb+LwRAN9w1X9wdxrpV9/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_76b99bab19549e006014367e88bcb1bcc3d1f201a04645b73aadd0f8f690b73d.exe
Size 7.5MB
SHA256 5459f722bad96a006dfb6437acedfacd29c53d7bc90831bcb16351913d477328
MD5 994a9cbb63712df4bcd003d6b7803c68
SHA1 681be7f985ef7a40b7d4b730f6d154667fb9ffc3
SHA512 bc3bdf020308ab4acab3c56eda24d9015d9ed0ba6497650c5b3ef0ce9655d06c3462bef7d5f9f99afbd99f5b8b243bdae76610359629247f73c4b12876e26464
SSDEEP 98304:ksSque4rU9qaddQfs+AOncxZ96hWylIPb4mVzArOSqeDalc6d:k/qt9qaUni6Yyw44c9BDal
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.7MB
SHA256 43452e3c4083079c05fc360e5c8ab50c1fd6eb044151dabf06dee83b1530d638
MD5 3f69f5e39603069b744440cc9a13499d
SHA1 19c5fb0c1bc37735a2580b94490a2a0a6b2ca935
SHA512 45bc03da8bfd2cc8329a83c3aef4f8e8e8382ab3a4b449946d6edc36922eb850cb4c5b78dbf1865f20f11239c4a912462808f55c17d88959c6dc0fa85d604c8e
SSDEEP 24576:5QZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVD:5QZAdVyVT9n/Gg0P+Who8
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchos.exe

Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
Size 93KB
SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
MD5 3b377ad877a942ec9f60ea285f7119a2
SHA1 60b23987b20d913982f723ab375eef50fafa6c70
SHA512 af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
SSDEEP 1536:ktbE7m8nNEQ2O6ReWMWfPbp2WTrW9L3JPPgJ+o5FJYHvh/P6:Bm+2LReWjTrW9rNPgYoTJYHvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 377KB
SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
MD5 a4329177954d4104005bce3020e5ef59
SHA1 23c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA512 81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YgL7:HclcceBKlKwAg0Mja/UafOVwbhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

240601062.txt

Path C:\Windows\SysWOW64\240601062.txt
Size 50KB
SHA256 989be5d5c6177e0d1dc3316cac5373f93003abac3ee8e7ebdff6b167e0900b70
MD5 1aeeff916b4d08c9cb7ec6d22d399f63
SHA1 4c139f07c570d4b4993287cbae1b7838cf0347a4
SHA512 1fad0f413d04711993c4da9a3305a9646d484910ab1a6dcf59fbf251a15e0023328030ecfb9ddbef0ddac77259892ee23727eb795be412b71e80268493211971
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5tJYH:W5ReWjTrW9rNPgYoPJYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/32-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/32-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/32-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/32-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/32-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1144-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1144-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1144-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1144-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3368-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3368-38-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3368-42-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3368-43-0x0000000010000000-0x00000000101B6000-memory.dmp

Download