djvu | 72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d

Analysis

max time kernel
178s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10-05-2022 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

buildp.exe
Size

841KB
MD5

efed57771cb41fdde63781d1e195912c
SHA1

a71b0545951c99eb6ad4a50c22d02c958003d920
SHA256

72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d
SHA512

6fd84f80ba5f3c53f48a6a0135cedc7b489cca419742e043116468bcda0898398dd7ddff4ac7d0d8b283312d4c411790b8ff74276f14016021597498b306a080

Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer suricata

Malware Config

Extracted

Family

djvu

http://fuyt.org/lancer/get.php

Attributes

extension
.gtys
offline_id
qwVQoIsE2xLety0oNWloOilSDuIBXJGK86LM3ot1
payload_url
http://zerit.top/dl/build2.exe

http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fnn5kv33Vv Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0439JIjdm

rsa_pubkey.plain

Extracted

Family

vidar

Version

Botnet

517

https://t.me/hollandracing

https://busshi.moe/@ronxik321

Attributes

profile_id
517

Signatures

Detected Djvu ransomware 8 IoCs

resource	yara_rule
behavioral2/memory/2612-131-0x0000000002390000-0x00000000024AB000-memory.dmp	family_djvu
behavioral2/memory/4004-133-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4004-134-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4004-135-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4004-136-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4236-143-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4236-144-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4236-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata

Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/4588-154-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar
behavioral2/memory/4588-156-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar
behavioral2/memory/5012-158-0x00000000005F0000-0x0000000000639000-memory.dmp	family_vidar
behavioral2/memory/4588-159-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar
behavioral2/memory/4588-160-0x0000000000400000-0x000000000044C000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5012	build2.exe
4588	build2.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	buildp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	buildp.exe

Loads dropped DLL 2 IoCs

pid	Process
4588	build2.exe
4588	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4264	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8530ed0f-ee90-4d2f-beb3-beb15e88ed35\\buildp.exe\" --AutoStart"	buildp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	api.2ip.ua
27	api.2ip.ua
42	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2612 set thread context of 4004	2612	buildp.exe	80
PID 1516 set thread context of 4236	1516	buildp.exe	86
PID 5012 set thread context of 4588	5012	build2.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	buildp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	buildp.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4004	buildp.exe
4004	buildp.exe
4236	buildp.exe
4236	buildp.exe
4588	build2.exe
4588	build2.exe
4588	build2.exe
4588	build2.exe
4588	build2.exe
4588	build2.exe
4588	build2.exe
4588	build2.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 2612 wrote to memory of 4004	2612	buildp.exe	80
PID 4004 wrote to memory of 4264	4004	buildp.exe	81
PID 4004 wrote to memory of 4264	4004	buildp.exe	81
PID 4004 wrote to memory of 4264	4004	buildp.exe	81
PID 4004 wrote to memory of 1516	4004	buildp.exe	82
PID 4004 wrote to memory of 1516	4004	buildp.exe	82
PID 4004 wrote to memory of 1516	4004	buildp.exe	82
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 1516 wrote to memory of 4236	1516	buildp.exe	86
PID 4236 wrote to memory of 5012	4236	buildp.exe	91
PID 4236 wrote to memory of 5012	4236	buildp.exe	91
PID 4236 wrote to memory of 5012	4236	buildp.exe	91
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92
PID 5012 wrote to memory of 4588	5012	build2.exe	92

C:\Users\Admin\AppData\Local\Temp\buildp.exe
"C:\Users\Admin\AppData\Local\Temp\buildp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\buildp.exe
  "C:\Users\Admin\AppData\Local\Temp\buildp.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\8530ed0f-ee90-4d2f-beb3-beb15e88ed35" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\buildp.exe
    "C:\Users\Admin\AppData\Local\Temp\buildp.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\buildp.exe
      "C:\Users\Admin\AppData\Local\Temp\buildp.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe
        
        "C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5012
      - C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe
        
        "C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\nss3.dll

Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
727B

MD5
e25910c9dde509fb4760477c89c6a4e7

SHA1
4b9d17d6b3629d88bc92663e2a706fa67b32490b

SHA256
05d4cc0a64e2fc232b3b4266c47d4925a30f8ba1d90f028646e3689a03a2f5ad

SHA512
a1ad80c2fe9798f3e90327f1775624d0ed3d07c10021ac627521d3eed9bb87b09797bf0fd7be4e302ec26efb7e5fc590c4a8c50cd9ed411796ee101fe156ce09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
471B

MD5
d5710c53f1f6105506249979b718c4a4

SHA1
c65a130aaec812b70a391ec99a749e4924977ff5

SHA256
2df6a7244a4daa65c6af33cb0eed7119dc6f6c3f7074ca39b6136da058e5645f

SHA512
c578d84534c0dfd73a844a9d88e0051f3c59bceda41b2806ce10d3cdda126e78cc26d4cb16de570294c17b187669cee9967916f17dd137ca40bc59bc36704603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
402B

MD5
f90ead84286017e32094c1594f59c5f8

SHA1
016cd719ae3d951823984105a724259ca632f0de

SHA256
bf1aaa00ceaf0bd837d3de094a42be9517ee866f05627f0036212cd490520182

SHA512
ec8494dcbe89252c1c91ec6fb51b94876b68c7e6e26510ebb09a4114fa6025da7f107c2e0c94bfb42b0da24d44c5bf763f493e27593f8786a083fade2d0195a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
396B

MD5
b3083c3ed35085985f748773f04c146e

SHA1
fb59a84b830589cf2869deb5d9b45a2917e98419

SHA256
b9006c42cbdad4af7f6ca46b2b901300635f72ad2c861d073885722a7e1f6e3c

SHA512
d974d8fcb927297b31c3a230c97d6e760cb821bebbc2e5bf192939ec424acb694c0d3437de79aa87586e6e6dc0a0e3ebb5b302a0c6f3d38ac14ac7cf1af513f2

Download Submit
C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe

Filesize
380KB

MD5
ba5461bef761e4e723c2567cfe710fe3

SHA1
92f94d48482ca2006caf4c50ac387d1b532e837b

SHA256
c9c82de52be77596153f54b192da4e91e671cc5ad01d6bfe0011fd8e9d5723fa

SHA512
24f0e12607ff0672c236e92193b659c5121059b5ae56545790830081835120aca464e003066455227d31ee8445787fdfbf90a8be29af9e837edbe7e808e11149

Download Submit
C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe

Filesize
380KB

MD5
ba5461bef761e4e723c2567cfe710fe3

SHA1
92f94d48482ca2006caf4c50ac387d1b532e837b

SHA256
c9c82de52be77596153f54b192da4e91e671cc5ad01d6bfe0011fd8e9d5723fa

SHA512
24f0e12607ff0672c236e92193b659c5121059b5ae56545790830081835120aca464e003066455227d31ee8445787fdfbf90a8be29af9e837edbe7e808e11149

Download Submit
C:\Users\Admin\AppData\Local\0d7c03c0-0131-4871-b014-a16aca28c082\build2.exe

Filesize
380KB

MD5
ba5461bef761e4e723c2567cfe710fe3

SHA1
92f94d48482ca2006caf4c50ac387d1b532e837b

SHA256
c9c82de52be77596153f54b192da4e91e671cc5ad01d6bfe0011fd8e9d5723fa

SHA512
24f0e12607ff0672c236e92193b659c5121059b5ae56545790830081835120aca464e003066455227d31ee8445787fdfbf90a8be29af9e837edbe7e808e11149

Download Submit
C:\Users\Admin\AppData\Local\8530ed0f-ee90-4d2f-beb3-beb15e88ed35\buildp.exe

Filesize
841KB

MD5
efed57771cb41fdde63781d1e195912c

SHA1
a71b0545951c99eb6ad4a50c22d02c958003d920

SHA256
72cd1426f13a698c7d63a288f4920147812303e8f10a4e66e414cc7c2206381d

SHA512
6fd84f80ba5f3c53f48a6a0135cedc7b489cca419742e043116468bcda0898398dd7ddff4ac7d0d8b283312d4c411790b8ff74276f14016021597498b306a080

Download Submit
memory/1516-142-0x00000000021B6000-0x0000000002247000-memory.dmp

Filesize
580KB

Download
memory/2612-131-0x0000000002390000-0x00000000024AB000-memory.dmp

Filesize
1.1MB

Download
memory/2612-130-0x0000000002255000-0x00000000022E6000-memory.dmp

Filesize
580KB

Download
memory/4004-135-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4004-134-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4004-136-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4004-133-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4236-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4236-143-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4236-144-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4588-161-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/4588-154-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4588-156-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4588-159-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4588-160-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5012-158-0x00000000005F0000-0x0000000000639000-memory.dmp

Filesize
292KB

Download
memory/5012-157-0x0000000000688000-0x00000000006B2000-memory.dmp

Filesize
168KB

Download