Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 18:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    146KB

  • MD5

    1ef9236c4026e83a8dde5e2d1707114a

  • SHA1

    32098d31aea8689ea7d1ed37833e10a42f015f3e

  • SHA256

    0097ca05b7f7021f71cc06e2e4d4f4929e401bf0afa352349b9e01d987dc0109

  • SHA512

    77625df4767a657ead12491015de857c3cbe0bcb12ba6bf5f088da1569f27d9fd94ede46279201c3aa7644ad7f40beb14f06138317c1634a77486d7610ede191

  • SSDEEP

    3072:0yFiga2yyvwin/cR0O24AyzFnBRI6aaPzfuQO:0yFyj8n/cRVLzFBKTWrt

Score
10/10
djvusmokeloadervidar517backdoorcollectiondiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Family

djvu

C2

http://winnlinne.com/lancer/get.php

Attributes
  • extension

    .adww

  • offline_id

    z8lhl4oForVEc7gy9Ra8rSqjYMl3xiFRuIW4not1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://winnlinne.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-g28rVcqA58 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0573Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.9

Botnet

517

C2

https://t.me/larsenup

https://ioc.exchange/@zebra54
Attributes
  • profile_id

    517

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Detects Smokeloader packer 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1216
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\374C.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:256
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\374C.dll
      2⤵
      • Loads dropped DLL
      PID:220
  • C:\Users\Admin\AppData\Local\Temp\38A5.exe
    C:\Users\Admin\AppData\Local\Temp\38A5.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\AppData\Local\Temp\38A5.exe
      C:\Users\Admin\AppData\Local\Temp\38A5.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\95e54584-38b4-41f3-98c9-4cc26ae0d13a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1188
      • C:\Users\Admin\AppData\Local\Temp\38A5.exe
        "C:\Users\Admin\AppData\Local\Temp\38A5.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1596
        • C:\Users\Admin\AppData\Local\Temp\38A5.exe
          "C:\Users\Admin\AppData\Local\Temp\38A5.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe
            "C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4544
            • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe
              "C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:1092
          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build3.exe
            "C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4528
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:2136
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
    • Accesses Microsoft Outlook profiles
    • outlook_office_path
    • outlook_win_path
    PID:1348
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    1⤵
      PID:880
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        2⤵
        • Creates scheduled task(s)
        PID:1364

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\mozglue.dll
            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            Download Submit

          • C:\ProgramData\nss3.dll
            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
            Filesize

            2KB

            MD5

            596d2fdcebb9285d08c83e8c66f21dc9

            SHA1

            d634a64d292467c4fe9f1b2b80ac3bf82a08d49f

            SHA256

            0231bc4602667ff24bfa1caab1d56c225a54031c452c9de84b810be18628a3e3

            SHA512

            fd0399c36455095561381c33ba0f6f98496dc2fd63792f148ec9dfbc06ed6ad24a6bf9aa7f559dba7f257ccd145ee8532418606c2eb282a42ca678de4231d818

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            1KB

            MD5

            b6f52795b677b4e2ad47736ffe3704a5

            SHA1

            945cb962aae5a0986c476650006227debf93b51c

            SHA256

            c8aff1f15506340e6abd76c8a8382e9caeba4fa8e8483254cf7ab9d22c2a57fe

            SHA512

            1e241b4c9bf53a97c980dd09bc73abcaf05ed8ccc641d5b0ad1eadc4502b4c1519b62d9c51f8e38c73898c2eca4a4a2e81777763731bf0f36dc5c04a30ae0450

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
            Filesize

            488B

            MD5

            40ecffefcd4e62533442696033dab4d5

            SHA1

            a5127120692eb4b602db3cd4c30986aca37ecc94

            SHA256

            4f1bbc0f4ad96e5853bed01d61e7f0873b7b11ebad05f5622a7cb746119824c4

            SHA512

            b2860c5ffd363fa69803f1336ea6c682e214e0ae648e7c7ffbed70d3638650222da694f9fdd5d0fc4a586e348f6accf1b9cd03fd0840e8ac83d074cfbf66bb6e

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            482B

            MD5

            624cbeeaec06992960d8a7b164329342

            SHA1

            39d1380eb0d616ad143902021e5e2add740589ed

            SHA256

            78e2ea5f4800b848238dc5df0138d4d30d7d374a4420080a4e92708e3345db08

            SHA512

            06d083ca9f8b2973a1a8132b530ee561e4954b371f86c4462cca0cdf0107edc596ea03686f7151a305eeb80a2db24ced7bb9b20230277f8ade4462e86c8a373e

            Download Submit

          • C:\Users\Admin\AppData\Local\95e54584-38b4-41f3-98c9-4cc26ae0d13a\38A5.exe
            Filesize

            664KB

            MD5

            d8a18175cdddf3915358213914dc8eb9

            SHA1

            0c51a93a7476891af1a617f4436326cde3ef5781

            SHA256

            5b049964157937146523b1a1caefa69a927aa46dbb1a0dce7871826bad7efffa

            SHA512

            8297764f0867bdde7f4d98e5ead6c1dea40469eb9d935a2355484e35324b8c206da15796f81ee9fd00a1b83f4b6bdd28d65fcf084eb0b1b3313dbdf8648603d3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\374C.dll
            Filesize

            1.3MB

            MD5

            4b7103b0104193655fc525e90d5ddb9e

            SHA1

            e54d3510f1821a0bb6e29612005e27ac94591771

            SHA256

            2696c088ac6b8a927c936d6bd50e5396526d71405a8f9edd0620b085a5308403

            SHA512

            84cf73bdc4139d5cf2cf1e15098a05c4ecddfa6296cdc63443b02183f9438b95845d619b65245aa78bebae38151d23d0aced42572d03a48d447f40fd713c225c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\374C.dll
            Filesize

            1.3MB

            MD5

            4b7103b0104193655fc525e90d5ddb9e

            SHA1

            e54d3510f1821a0bb6e29612005e27ac94591771

            SHA256

            2696c088ac6b8a927c936d6bd50e5396526d71405a8f9edd0620b085a5308403

            SHA512

            84cf73bdc4139d5cf2cf1e15098a05c4ecddfa6296cdc63443b02183f9438b95845d619b65245aa78bebae38151d23d0aced42572d03a48d447f40fd713c225c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\38A5.exe
            Filesize

            664KB

            MD5

            d8a18175cdddf3915358213914dc8eb9

            SHA1

            0c51a93a7476891af1a617f4436326cde3ef5781

            SHA256

            5b049964157937146523b1a1caefa69a927aa46dbb1a0dce7871826bad7efffa

            SHA512

            8297764f0867bdde7f4d98e5ead6c1dea40469eb9d935a2355484e35324b8c206da15796f81ee9fd00a1b83f4b6bdd28d65fcf084eb0b1b3313dbdf8648603d3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\38A5.exe
            Filesize

            664KB

            MD5

            d8a18175cdddf3915358213914dc8eb9

            SHA1

            0c51a93a7476891af1a617f4436326cde3ef5781

            SHA256

            5b049964157937146523b1a1caefa69a927aa46dbb1a0dce7871826bad7efffa

            SHA512

            8297764f0867bdde7f4d98e5ead6c1dea40469eb9d935a2355484e35324b8c206da15796f81ee9fd00a1b83f4b6bdd28d65fcf084eb0b1b3313dbdf8648603d3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\38A5.exe
            Filesize

            664KB

            MD5

            d8a18175cdddf3915358213914dc8eb9

            SHA1

            0c51a93a7476891af1a617f4436326cde3ef5781

            SHA256

            5b049964157937146523b1a1caefa69a927aa46dbb1a0dce7871826bad7efffa

            SHA512

            8297764f0867bdde7f4d98e5ead6c1dea40469eb9d935a2355484e35324b8c206da15796f81ee9fd00a1b83f4b6bdd28d65fcf084eb0b1b3313dbdf8648603d3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\38A5.exe
            Filesize

            664KB

            MD5

            d8a18175cdddf3915358213914dc8eb9

            SHA1

            0c51a93a7476891af1a617f4436326cde3ef5781

            SHA256

            5b049964157937146523b1a1caefa69a927aa46dbb1a0dce7871826bad7efffa

            SHA512

            8297764f0867bdde7f4d98e5ead6c1dea40469eb9d935a2355484e35324b8c206da15796f81ee9fd00a1b83f4b6bdd28d65fcf084eb0b1b3313dbdf8648603d3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\38A5.exe
            Filesize

            664KB

            MD5

            d8a18175cdddf3915358213914dc8eb9

            SHA1

            0c51a93a7476891af1a617f4436326cde3ef5781

            SHA256

            5b049964157937146523b1a1caefa69a927aa46dbb1a0dce7871826bad7efffa

            SHA512

            8297764f0867bdde7f4d98e5ead6c1dea40469eb9d935a2355484e35324b8c206da15796f81ee9fd00a1b83f4b6bdd28d65fcf084eb0b1b3313dbdf8648603d3

            Download Submit

          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe
            Filesize

            255KB

            MD5

            9c3d4324a153c6438f48083bc333a962

            SHA1

            033e80e2008f4f62d2716ce0473bb0d763d52277

            SHA256

            5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98

            SHA512

            8cce276e59b2fcdb333fecaaa1e3ab9d0b24e25c54a6fc959b6c190441061fab67ea0d35e7077cf910b557b6a60b90c1d2260352b11789bbcd430814fcff51cd

            Download Submit

          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe
            Filesize

            255KB

            MD5

            9c3d4324a153c6438f48083bc333a962

            SHA1

            033e80e2008f4f62d2716ce0473bb0d763d52277

            SHA256

            5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98

            SHA512

            8cce276e59b2fcdb333fecaaa1e3ab9d0b24e25c54a6fc959b6c190441061fab67ea0d35e7077cf910b557b6a60b90c1d2260352b11789bbcd430814fcff51cd

            Download Submit

          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build2.exe
            Filesize

            255KB

            MD5

            9c3d4324a153c6438f48083bc333a962

            SHA1

            033e80e2008f4f62d2716ce0473bb0d763d52277

            SHA256

            5ee57d85a41b825060864ae85981253f28148d15586a5f6274d562dfeae93e98

            SHA512

            8cce276e59b2fcdb333fecaaa1e3ab9d0b24e25c54a6fc959b6c190441061fab67ea0d35e7077cf910b557b6a60b90c1d2260352b11789bbcd430814fcff51cd

            Download Submit

          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build3.exe
            Filesize

            9KB

            MD5

            9ead10c08e72ae41921191f8db39bc16

            SHA1

            abe3bce01cd34afc88e2c838173f8c2bd0090ae1

            SHA256

            8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

            SHA512

            aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

            Download Submit

          • C:\Users\Admin\AppData\Local\f315a0b2-91b2-4d53-a29e-39ce530b5a05\build3.exe
            Filesize

            9KB

            MD5

            9ead10c08e72ae41921191f8db39bc16

            SHA1

            abe3bce01cd34afc88e2c838173f8c2bd0090ae1

            SHA256

            8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

            SHA512

            aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            Filesize

            9KB

            MD5

            9ead10c08e72ae41921191f8db39bc16

            SHA1

            abe3bce01cd34afc88e2c838173f8c2bd0090ae1

            SHA256

            8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

            SHA512

            aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            Filesize

            9KB

            MD5

            9ead10c08e72ae41921191f8db39bc16

            SHA1

            abe3bce01cd34afc88e2c838173f8c2bd0090ae1

            SHA256

            8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

            SHA512

            aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

            Download Submit

          • memory/220-164-0x0000000002850000-0x0000000002950000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/220-172-0x0000000002A10000-0x0000000002AB9000-memory.dmp

            Filesize

            676KB

            Download

          • memory/220-165-0x0000000002950000-0x0000000002A0E000-memory.dmp

            Filesize

            760KB

            Download

          • memory/220-163-0x0000000002640000-0x0000000002744000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/880-153-0x0000000000BF0000-0x0000000000BFC000-memory.dmp

            Filesize

            48KB

            Download

          • memory/1092-194-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

            Download

          • memory/1092-192-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

            Download

          • memory/1092-219-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

            Download

          • memory/1092-188-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

            Download

          • memory/1092-195-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

            Download

          • memory/1216-134-0x0000000000400000-0x0000000000581000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1216-132-0x00000000007BD000-0x00000000007CE000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1216-135-0x00000000007BD000-0x00000000007CE000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1216-136-0x0000000000400000-0x0000000000581000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1216-133-0x0000000000720000-0x0000000000729000-memory.dmp

            Filesize

            36KB

            Download

          • memory/1348-159-0x0000000000500000-0x000000000056B000-memory.dmp

            Filesize

            428KB

            Download

          • memory/1348-154-0x0000000000570000-0x00000000005E5000-memory.dmp

            Filesize

            468KB

            Download

          • memory/1348-156-0x0000000000500000-0x000000000056B000-memory.dmp

            Filesize

            428KB

            Download

          • memory/1596-170-0x000000000225D000-0x00000000022EF000-memory.dmp

            Filesize

            584KB

            Download

          • memory/1772-149-0x0000000000866000-0x00000000008F8000-memory.dmp

            Filesize

            584KB

            Download

          • memory/1772-150-0x0000000002390000-0x00000000024AB000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/2356-146-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2356-148-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2356-155-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2356-162-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2356-151-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4308-169-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4308-174-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4308-171-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4308-218-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4544-193-0x00000000021C0000-0x000000000220A000-memory.dmp

            Filesize

            296KB

            Download

          • memory/4544-191-0x00000000005DD000-0x0000000000609000-memory.dmp

            Filesize

            176KB

            Download