djvu | 72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d

Analysis

max time kernel
57s
max time network
122s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-04-2022 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

buildp.exe
Size

841KB
MD5

efed57771cb41fdde63781d1e195912c
SHA1

a71b0545951c99eb6ad4a50c22d02c958003d920
SHA256

72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d
SHA512

6fd84f80ba5f3c53f48a6a0135cedc7b489cca419742e043116468bcda0898398dd7ddff4ac7d0d8b283312d4c411790b8ff74276f14016021597498b306a080

Score

10^/10

djvu discovery persistence ransomware suricata

Malware Config

Extracted

Family

djvu

http://fuyt.org/lancer/get.php

Attributes

extension
.gtys
offline_id
qwVQoIsE2xLety0oNWloOilSDuIBXJGK86LM3ot1
payload_url
http://zerit.top/dl/build2.exe

http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fnn5kv33Vv Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0439JIjdm

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 8 IoCs

resource	yara_rule
behavioral1/memory/884-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/884-56-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/960-59-0x0000000001D80000-0x0000000001E9B000-memory.dmp	family_djvu
behavioral1/memory/884-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/884-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1112-68-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1112-72-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1112-78-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1216	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ac8b3858-4011-459b-97fd-4b7f805603e0\\buildp.exe\" --AutoStart"	buildp.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.2ip.ua
12	api.2ip.ua
3	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 884	960	buildp.exe	27
PID 1920 set thread context of 1112	1920	buildp.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	buildp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	buildp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	buildp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	buildp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	buildp.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
884	buildp.exe
1112	buildp.exe
1112	buildp.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 960 wrote to memory of 884	960	buildp.exe	27
PID 884 wrote to memory of 1216	884	buildp.exe	30
PID 884 wrote to memory of 1216	884	buildp.exe	30
PID 884 wrote to memory of 1216	884	buildp.exe	30
PID 884 wrote to memory of 1216	884	buildp.exe	30
PID 884 wrote to memory of 1920	884	buildp.exe	31
PID 884 wrote to memory of 1920	884	buildp.exe	31
PID 884 wrote to memory of 1920	884	buildp.exe	31
PID 884 wrote to memory of 1920	884	buildp.exe	31
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32
PID 1920 wrote to memory of 1112	1920	buildp.exe	32

C:\Users\Admin\AppData\Local\Temp\buildp.exe
"C:\Users\Admin\AppData\Local\Temp\buildp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\buildp.exe
  "C:\Users\Admin\AppData\Local\Temp\buildp.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\ac8b3858-4011-459b-97fd-4b7f805603e0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\buildp.exe
    "C:\Users\Admin\AppData\Local\Temp\buildp.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\buildp.exe
      "C:\Users\Admin\AppData\Local\Temp\buildp.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
727B

MD5
d9c694c2d95c6812aa0be903de46da96

SHA1
df1a733a9c6c27997c798ae4c5715cabe1ffa5e4

SHA256
f6f85bc0d1770803a206fbfb83c4cb888b3a24b494feac38baa3ea764cda37c0

SHA512
97a2eddf197aa74d1d05241008ead092f836b561bc1ad1d731d91db23d6dcce7a65d3dc1609384a3ad3fd5c858bae6c3a4361588b5a965ebf233f14410864793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
471B

MD5
ad8e032271f02af2a955ce10661cc3a8

SHA1
967d1bd99bea34c3110cc75c0c0d8b8565eae9f9

SHA256
d5081bf75d530e9336a6da0f9142bc10f4d06368c365cf0e33f7c99b0f643ce8

SHA512
bc69dfb03284cf1b8d172ff55938f238b928a0c7846306d8232ab697f54c771a9acf8b0e04a85e149da87ea8cfd9395605d0d95afc30eae1793e91399aa7eef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
402B

MD5
56e3521b3870ba5e751351d81595e214

SHA1
f093ff3595ebc3ce5106cbcc7ad8ecda8e45ff1e

SHA256
9b8af4686b2c53055a6d78157374c1ae639e3b4237a8aec19fdbcce6456abecb

SHA512
9955c5fa9da6d6e05b3b090c82f999e4f2c1fc7f26dd2beef9d0f154871ea3aecd1820dee32554ceccb21738602a3260218be35bec4e36d36b40a9f0f2a9781f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
506554edca41b899a89be2bc9144e786

SHA1
51a7e5dc7a507decb5dc47605660c725b54f3ce1

SHA256
dfac27be4e08f5f767b1e9c9df0c35dd6d338f49836313c81753f493aab80873

SHA512
589458d7548f3acd8a2120f8b94510d578f04cfb648931c023fbb22996a8df904037e9c0b8f8fb7e2a0a0f2ea209c992db11cfa4537ef9626087595f86d7d0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
396B

MD5
637529ce20aa05b3c687a6eabbc0d698

SHA1
d954f9d9075329ab50b218f43670001893d19465

SHA256
28b1386bbe214f2a9a1dda23193480cbe8abfc931af520cecaac9d9bfba8ca92

SHA512
4a9688faed3ef4909b039c6db82111a4d42ff60c0f2c6ae7a2c2b268cc3616213d70b817a030ae7c9ff82d283a6f7b1b24db9fc3327f6ce3efae6785e185089b

Download Submit
C:\Users\Admin\AppData\Local\ac8b3858-4011-459b-97fd-4b7f805603e0\buildp.exe

Filesize
841KB

MD5
efed57771cb41fdde63781d1e195912c

SHA1
a71b0545951c99eb6ad4a50c22d02c958003d920

SHA256
72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d

SHA512
6fd84f80ba5f3c53f48a6a0135cedc7b489cca419742e043116468bcda0898398dd7ddff4ac7d0d8b283312d4c411790b8ff74276f14016021597498b306a080

Download Submit
memory/884-60-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/884-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/884-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/884-55-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/960-54-0x0000000001CE0000-0x0000000001D71000-memory.dmp

Filesize
580KB

Download
memory/960-59-0x0000000001D80000-0x0000000001E9B000-memory.dmp

Filesize
1.1MB

Download
memory/960-58-0x0000000001CE0000-0x0000000001D71000-memory.dmp

Filesize
580KB

Download
memory/1112-78-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1112-72-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1920-70-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/1920-66-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download