globeimposter | 0235da1b6cbf432951f9e07b59e2364fd2255bf785e7b66588ee409525aa8b58

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23/02/2025, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
Size

884KB
MD5

034580c52732e52a382f4d550c34f09c
SHA1

bd4f5d3d0ca9d9d80f001666435f5d88006e75b8
SHA256

185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430
SHA512

300f9215a323e87d808791381bfc6e56d5fdfd8c0dcf9ceb19474e30e67557951d501da4a7a6cfdd5992450dc17bdd37144f342ab5ec9f7ec0f449e703c79074
SSDEEP

12288:xroyEyv4LcKJYtcYpnOFWxLNRG2t8ruYwvs8VydFw5fawhyoUMFWcBN8gqJ:xrLv4L3YCcLNkcTMFw5fyHo

Score

10^/10

globeimposter defense_evasion discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Public\Videos\read-me.txt

Family

globeimposter

Ransom Note

All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ��08 1B 62 D6 E2 6F AE C6 6E 4B 85 94 70 5C 3B B1 39 83 8A 1A F4 11 50 56 CC 14 92 3B 7F D1 14 4F 35 BD 40 65 BF 3A C9 EE 9F EF 59 9E 35 89 84 EB 4E 5A D7 68 DC A1 C5 3C CD C1 FF FB 68 85 30 A7 9D C6 18 06 1F 00 D5 C5 E5 93 99 6A EA C5 91 9D 71 A1 63 A0 F4 9A 57 E1 F7 60 4A 4D BF F8 13 83 0C 15 F9 59 22 92 D3 55 4B 79 BC CB CA E4 94 74 BD 9C 7A A7 94 58 99 7D 66 1F AD 26 90 C0 51 C4 C7 8C 30 4D 2E F8 F6 96 0A A6 D0 45 55 B9 16 70 C5 44 C8 6F 14 B8 EC 0E 89 D0 40 34 D6 C6 76 CF 40 EC 05 32 B2 D8 7B DD 6A 2C 9D A8 3A 2A 6D E4 EC 82 4A 5E 88 5A 38 F1 C0 49 DF C1 09 8F 1B 03 86 ED EB 49 F7 8B E3 7A 7D 41 33 3E FE A3 57 C9 B6 B8 F8 C1 B4 EC EC 6C B8 CC E6 8B E5 9D 64 25 19 2E EF 19 C6 F0 C9 A7 73 65 24 26 67 98 30 03 F6 20 77 BF 9D 20 15 8C 58 5F 16 9B 03 6F D5 DF

URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Globeimposter family
globeimposter
Renames multiple (8657) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\TpmInit.exe"	TpmInit.exe

Drops desktop.ini file(s) 38 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	TpmInit.exe
File opened for modification	C:\Program Files\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	TpmInit.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	TpmInit.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	TpmInit.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	TpmInit.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2592 set thread context of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLINACC.DPV	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR35F.GIF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00703L.GIF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02268_.WMF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_nl.dll	TpmInit.exe
File opened for modification	C:\Program Files\RegisterBlock.midi	TpmInit.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER11.POC	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18225_.WMF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_en.dub	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29B.GIF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152594.WMF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185818.WMF	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITS.ICO	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REC.CFG	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF	TpmInit.exe
File opened for modification	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\LASER.WAV	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02736G.GIF	TpmInit.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\read-me.txt	TpmInit.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05665_.WMF	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM	TpmInit.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll	TpmInit.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\read-me.txt	TpmInit.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo	TpmInit.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR17F.GIF	TpmInit.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Edmonton	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01770_.GIF	TpmInit.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15172_.GIF	TpmInit.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	TpmInit.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo	TpmInit.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png	TpmInit.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml	TpmInit.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF	TpmInit.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar	TpmInit.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	TpmInit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpmInit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2596	TpmInit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2592 wrote to memory of 2596	2592	185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe	30
PID 2596 wrote to memory of 760	2596	TpmInit.exe	33
PID 2596 wrote to memory of 760	2596	TpmInit.exe	33
PID 2596 wrote to memory of 760	2596	TpmInit.exe	33
PID 2596 wrote to memory of 760	2596	TpmInit.exe	33

C:\Users\Admin\AppData\Local\Temp\185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe
"C:\Users\Admin\AppData\Local\Temp\185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\TpmInit.exe
  "C:\Windows\SysWOW64\TpmInit.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\TpmInit.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini

Filesize
1KB

MD5
f0c9a4de9597706bca6d9283a2dcbfe1

SHA1
0400348fd65dfbc51ba8d34e22ca4fd91d7d4db1

SHA256
83433efb4e4076f75fd0a5661dc5a04067e94b61f7f987087f6c55489246cb7f

SHA512
20c880af9747a19c88c4f5960be72fd3be3fc2c44ca416501a4c721a2bd202e841315c1dcbfce2dcf70b5e2c6e9dafed402a18aa6992fcc1f5b8bde8fd430732

Download Submit
C:\Users\Public\Videos\read-me.txt

Filesize
1KB

MD5
ae19c4b0ab46aee8be668a9df7f3ac22

SHA1
e4f4de23cbe04c583b66251eb0e90521534203e5

SHA256
4ccfa7cd9ba5d9998c65b93f0c91b242155dff0857ddb8956e82f30a19432654

SHA512
d5add3d1490f1ca80c8c2be04dd32f895814b11e3c949589710fdd3082cbaf549ce1ef894ad68a4c2561accc41fbfe05ab009bf15e25bc1efbc1b8324f42348c

Download Submit
memory/2592-1-0x0000000000300000-0x00000000003E4000-memory.dmp

Filesize
912KB

Download
memory/2592-2-0x00000000007F0000-0x0000000000892000-memory.dmp

Filesize
648KB

Download
memory/2592-3-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/2592-4-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2592-0-0x00000000741FE000-0x00000000741FF000-memory.dmp

Filesize
4KB

Download
memory/2592-369-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2596-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2596-9-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2596-15-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2596-18-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2596-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-13-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2596-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download