Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 07:39
Static task
static1
Behavioral task
behavioral1
Sample
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe
Resource
win10v2004-20240426-en
General
-
Target
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe
-
Size
996KB
-
MD5
7bc116412e5131029d0b81b194090084
-
SHA1
ed73934bfb0362226c2d3e17113c2a505716ca3a
-
SHA256
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1
-
SHA512
d664eb1eb17e40ccc37e3c7c2f3f570d36ee043803fe4a251ec7a1759b0fe412146f422e16fb9adbf43c99ec39c8c8f7cbf23df1f6a1b4275076d805307c57ea
-
SSDEEP
24576:OmOOHW1ZNlw5K0I4UCSAlxERtrkgDIOFga1/DENAFwg:tOcSlwMRkskgM+goENAag
Malware Config
Extracted
djvu
http://zfko.org/test1/get.php
-
extension
.bnrs
-
offline_id
URlHYl9uzo6mBbGgVptZ7rlKxff0eZ2dOAMB2st1
-
payload_url
http://zerit.top/dl/build2.exe
http://zfko.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-e3y9ACpD1Y Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0494JIjdm
Signatures
-
Detected Djvu ransomware 13 IoCs
Processes:
resource yara_rule behavioral1/memory/2612-10-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2612-14-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2612-35-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-44-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-57-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-58-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-59-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-61-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-64-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-65-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-62-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-66-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2484-67-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\24be835d-4ce1-4f6f-87c9-37aa1ea747ae\\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe\" --AutoStart" 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.2ip.ua 4 api.2ip.ua 9 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exedescription pid process target process PID 2400 set thread context of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 set thread context of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exepid process 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 2484 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 2484 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exedescription pid process target process PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2400 wrote to memory of 2612 2400 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2612 wrote to memory of 2728 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe icacls.exe PID 2612 wrote to memory of 2728 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe icacls.exe PID 2612 wrote to memory of 2728 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe icacls.exe PID 2612 wrote to memory of 2728 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe icacls.exe PID 2612 wrote to memory of 2464 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2612 wrote to memory of 2464 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2612 wrote to memory of 2464 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2612 wrote to memory of 2464 2612 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe PID 2464 wrote to memory of 2484 2464 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe 9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe"C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe"C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\24be835d-4ce1-4f6f-87c9-37aa1ea747ae" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe"C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe"C:\Users\Admin\AppData\Local\Temp\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5984591c7c475e1fbaa38e7a1107ca546
SHA12f5bba5480eea8e0364cf2d2017fc21c1a121e90
SHA256f4f6f23923a3ac14eb66148d13837d6f134d2691e2ba067aaba13a6747efce0f
SHA512852574ed4a2bfebeb17039e59508f15dfe17a90cd73dce34b812d33b8bcd2f9e0347b0efb841e5747ecb677cef69f4106781cdf9464175f801ee533cd0a1ae69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD573d420d6421e65527e812a31a37b759a
SHA113766ab8e77f221a84e72fa08cc365ad03a92955
SHA256e1cece0c5a11635c8b90ec910eb80776a36a729c1a95c3f90995a8cb8610be1d
SHA5121d2763cf27e80618fcb7e8dfe394720fae2f12284e82956f2e32e390d486be4ba5267f930a2ece328a5734a35313a11294bf25b52675ed6440ae6598b4cefc86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58e936d9fe2a26f3fb9b68509664e5fac
SHA1dd88801caa533fc432d983dcee028510ed95d129
SHA256259e6b06eb73d4dc6d857471fe8332487d3195142f0dc4339fde909465671606
SHA51264c795527cb12d359544db4e8e250db7517170f8b74848e9c220c080f3fbda33441dade1eeaf98f295d65989494dcddc37656584049c74fb36bbdbcc4936329e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD56e5038ec68c97c43694c903ce09b58cd
SHA1515d7534cfdc2f905aef9ef4474b0d9147fb9f4d
SHA25695a921fae39ffe0f6bbde832238d4c425fa88457b6fc4c0d925d6b67eeebc08b
SHA512e13cadd028bb08eaa01323243f9edc2b5d6540e3f0069d7b6d0b8f281ef196b30c9628d46998ebe713a9aeb8a0495965be683fd52173b5ee2c08a7c04d03b2be
-
C:\Users\Admin\AppData\Local\24be835d-4ce1-4f6f-87c9-37aa1ea747ae\9aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1.exeFilesize
996KB
MD57bc116412e5131029d0b81b194090084
SHA1ed73934bfb0362226c2d3e17113c2a505716ca3a
SHA2569aedfb95f7169cfc19238305393dd2b31eabb1169f8ec41e3decd9ecda5bccc1
SHA512d664eb1eb17e40ccc37e3c7c2f3f570d36ee043803fe4a251ec7a1759b0fe412146f422e16fb9adbf43c99ec39c8c8f7cbf23df1f6a1b4275076d805307c57ea
-
C:\Users\Admin\AppData\Local\Temp\Cab3708.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
memory/2400-2-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2400-8-0x0000000000360000-0x00000000003F1000-memory.dmpFilesize
580KB
-
memory/2400-12-0x0000000000220000-0x000000000025D000-memory.dmpFilesize
244KB
-
memory/2400-7-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-1-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-15-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-13-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/2400-3-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-16-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-0-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-4-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2400-5-0x0000000000220000-0x000000000025D000-memory.dmpFilesize
244KB
-
memory/2400-6-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/2464-43-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2464-40-0x0000000000310000-0x00000000003A1000-memory.dmpFilesize
580KB
-
memory/2464-39-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2464-37-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2464-36-0x0000000000400000-0x0000000002E5B000-memory.dmpFilesize
42.4MB
-
memory/2464-38-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2484-58-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-61-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-67-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-44-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-59-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-57-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-66-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-62-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-65-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2484-64-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2612-10-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2612-35-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2612-14-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2612-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB