Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
-
submitted
23-09-2023 20:50
General
-
Target
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe
-
Size
1.7MB
-
MD5
a6ab201ae407fbe4a5da5f20dc38412b
-
SHA1
b3f8caf67f36730ad87031d206db91c861980615
-
SHA256
9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf
-
SHA512
eb0e97119784d4f60ac5b1c499e4bdfa885243c8859d79e92e1c07a2aba3539606e5df978d8d63d7764fe898e691488a53d02fc495dc837b930cfe3d83cede2b
-
SSDEEP
24576:fp1vJ+VbHGsD+KBrdrDeZYeGMqrK5Nt9Z64JrQTwkMZddfy6Tsqp+RjfMst:x3KpyJrQTwo6Tszgs
Score
10/10
Malware Config
Extracted
Path
C:\info.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>cartilage</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language='JScript'>
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type='text/css'>
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #C6B5C4;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #B5CC8E;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #e6ecf2;
border-left: 10px solid #B58CB2;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FFA07A;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</head>
<body>
<div class='header'>
<img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='>
<div>All your files have been encrypted!</div>
</div>
<div class='bold'>All your files have been encrypted due to a security problem with your PC.</div>
<div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div>
<div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div>
<div class='bold'>Write this ID in the title of your message <span class='mark'>2CE376C5-3483</span></div>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>
Emails
class='mark'>[email protected]</span></div>
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
Path
C:\Users\Admin\Desktop\info.hta
Ransom Note
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC.
If you want to restore them, write us to the e-mail [email protected]
Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074
Write this ID in the title of your message 2CE376C5-3483
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
-
Renames multiple (448) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exeC:\Users\Admin\AppData\Local\Temp\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[2CE376C5-3483].[[email protected]].8baseFilesize
2.7MB
MD5b99c5d09e8e938c1e0da1e89ec1e2621
SHA19b32086656babeb14297f89e2f52e54b0af86c35
SHA256996c8b432d7137406f5f024a86b865f97ac19290ac34b23c5521f9ebf6324c66
SHA512f8d8fc438ed84bdef57879eb8edcc7163f565733df654ea9d55f5b2ad226665a08ae77be901c5d6bcd541ad00b4d8ae4750d51c2f0bf94907f2707b266fa9a56
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9d163fbffc9692a3143362c51d35d5ab52d1f209d9d5e053196c79a30e6f7acf.exe.logFilesize
927B
MD5ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1af407275e9830d40889da2e672d2e6af118c8cb8
SHA25672653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c
-
C:\Users\Admin\Desktop\info.htaFilesize
5KB
MD5157d9883541770a6ee9fa6bb00672c68
SHA16194f86b5584f226d8f1a22e2704a0f9d5b6a1c1
SHA256243941f8e2faa10ab77b66e753ea7884f054c8f953065037b4f41e63dcf9bdef
SHA5129fd56bd54d96d3a9dd8da0a01d7d0733d82f63826491684c7cfc5fbfaf21fc6e784ee4ea6680e03447fbc9f74ff3956e3f3d1da40bcef11eb40dacf30b2a2ec3
-
C:\info.htaFilesize
5KB
MD5157d9883541770a6ee9fa6bb00672c68
SHA16194f86b5584f226d8f1a22e2704a0f9d5b6a1c1
SHA256243941f8e2faa10ab77b66e753ea7884f054c8f953065037b4f41e63dcf9bdef
SHA5129fd56bd54d96d3a9dd8da0a01d7d0733d82f63826491684c7cfc5fbfaf21fc6e784ee4ea6680e03447fbc9f74ff3956e3f3d1da40bcef11eb40dacf30b2a2ec3
-
C:\info.htaFilesize
5KB
MD5157d9883541770a6ee9fa6bb00672c68
SHA16194f86b5584f226d8f1a22e2704a0f9d5b6a1c1
SHA256243941f8e2faa10ab77b66e753ea7884f054c8f953065037b4f41e63dcf9bdef
SHA5129fd56bd54d96d3a9dd8da0a01d7d0733d82f63826491684c7cfc5fbfaf21fc6e784ee4ea6680e03447fbc9f74ff3956e3f3d1da40bcef11eb40dacf30b2a2ec3
-
C:\users\public\desktop\info.htaFilesize
5KB
MD5157d9883541770a6ee9fa6bb00672c68
SHA16194f86b5584f226d8f1a22e2704a0f9d5b6a1c1
SHA256243941f8e2faa10ab77b66e753ea7884f054c8f953065037b4f41e63dcf9bdef
SHA5129fd56bd54d96d3a9dd8da0a01d7d0733d82f63826491684c7cfc5fbfaf21fc6e784ee4ea6680e03447fbc9f74ff3956e3f3d1da40bcef11eb40dacf30b2a2ec3
-
F:\info.htaFilesize
5KB
MD5157d9883541770a6ee9fa6bb00672c68
SHA16194f86b5584f226d8f1a22e2704a0f9d5b6a1c1
SHA256243941f8e2faa10ab77b66e753ea7884f054c8f953065037b4f41e63dcf9bdef
SHA5129fd56bd54d96d3a9dd8da0a01d7d0733d82f63826491684c7cfc5fbfaf21fc6e784ee4ea6680e03447fbc9f74ff3956e3f3d1da40bcef11eb40dacf30b2a2ec3
-
memory/2628-6-0x0000000005850000-0x0000000005D4E000-memory.dmpFilesize
5.0MB
-
memory/2628-0-0x0000000000770000-0x0000000000922000-memory.dmpFilesize
1.7MB
-
memory/2628-11-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/2628-5-0x00000000052B0000-0x00000000052FC000-memory.dmpFilesize
304KB
-
memory/2628-4-0x0000000005260000-0x0000000005294000-memory.dmpFilesize
208KB
-
memory/2628-3-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2628-2-0x0000000005210000-0x0000000005256000-memory.dmpFilesize
280KB
-
memory/2628-1-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/2932-144-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-185-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-32-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-36-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-35-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-37-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-49-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-7-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-84-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-110-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-69-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-38-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-10-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-153-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-207-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-30-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-211-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-217-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-246-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-251-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-415-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-536-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-667-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-1464-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-1489-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-12077-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2932-12-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3800-20-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4636-14-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/4636-15-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB
-
memory/4636-18-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB