Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    133s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/12/2022, 20:21

General

  • Target

    e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe

  • Size

    804KB

  • MD5

    4ee2a9eeb508e0415820f40548f62ac8

  • SHA1

    262ba14d7f2ab7a1cedcf15659f38f8bf5fa54d9

  • SHA256

    e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0

  • SHA512

    2b9d7d6064d6f7f82ffa47cd7a4aae5f8e0abfb308fbb306ca1e3860b0e554687d2bc6a058820350b1fc31385f7ce239855cff48d2ff243db8a76c23562540d9

  • SSDEEP

    12288:o7JA66sZ8VflbiiL2PXMpaWq1eZyTCbEWr1fns9Er1AccNYyoFNvmqdjJQZW:yKmWBKPXdeZyTCbt+E6caHAvdlQI

Malware Config

Extracted

Family

djvu

C2

http://abibiall.com/test1/get.php

Attributes
  • extension

    .isal

  • offline_id

    m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://abibiall.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0620IsgU

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe
    "C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe
      "C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\b207a29f-04a5-4d53-8343-27e0c9572898" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1200
      • C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe
        "C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe
          "C:\Users\Admin\AppData\Local\Temp\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe
            "C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4460
            • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe
              "C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:508
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe" & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1196
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  8⤵
                  • Delays execution with timeout.exe
                  PID:4828
          • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build3.exe
            "C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4628
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:2964
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    0f419c66dbc4946c001394e2910c173d

    SHA1

    e988a2291023e4c29b6442bfdeaacd9a83f0c640

    SHA256

    763aeee4de549d18d1e3a30be29961f5ffe2ce794179d13a06f44dd57a0b6b48

    SHA512

    c9d6c5459b055cecec7d7ed00f7774144b06fb2a4511bfc110a83577ed4517595a325f51e0579238d28550cf76de0a276f9d8bc322898c763b987a649e643918

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    c6964c598d970f6c97ea4092e97d517d

    SHA1

    690351843ee9c5dae635519f869192bb786207c6

    SHA256

    8901c2d40e486f904090f6ee8e107197cdb876c5bfe5fd7ce2d212e3330eba4a

    SHA512

    7fbaf67a4c6f9603c11ccfb42e65a42841c5f68baaf6817b84e0b48ad036636772adf06bc00b9b31ca33342b4c43854f6e5e750247bc718dd6ad1d5342e38aae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    059957de4c52dbbd617581d70e2b24db

    SHA1

    5bc1ec1cb3daee724a25b6fc152399f251d8daed

    SHA256

    04ee1bb38fb5dc8a3cbd40db6b8bded33fb0dc107767d167f3fa6cec41d2eb9d

    SHA512

    0adeedb37d655d856fbfdebf15fe62a971d1f28d67e873591bd34fdeb9b9b6d1c251cd728f5c10b06400120a15e8b2bc1100fe4f5f9aab7c3b55fbdd4a0bc03f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    03b05f2cead551ccf837fa74125bd2be

    SHA1

    788c579c2a82f7c1b978a870cf197de6a2bacf6a

    SHA256

    90fe0834998d0c8efb887710915a182af2bd23442876f546730b8c49b33517cf

    SHA512

    f1b48668e26ea32a477a6f2eef9246d521e503d820d41ef9b503ea22d2399d73d16e8b988ff63ebb1ad142a33fdc7abf6e55f573215d02c56aabee99c95fc1a8

  • C:\Users\Admin\AppData\Local\b207a29f-04a5-4d53-8343-27e0c9572898\e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0.exe

    Filesize

    804KB

    MD5

    4ee2a9eeb508e0415820f40548f62ac8

    SHA1

    262ba14d7f2ab7a1cedcf15659f38f8bf5fa54d9

    SHA256

    e2abe2358160b35e449b8fb77fe4bf5b06d1d7675925641b99a4bddfe0a045a0

    SHA512

    2b9d7d6064d6f7f82ffa47cd7a4aae5f8e0abfb308fbb306ca1e3860b0e554687d2bc6a058820350b1fc31385f7ce239855cff48d2ff243db8a76c23562540d9

  • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe

    Filesize

    409KB

    MD5

    a131064868de7468d2e768211431401b

    SHA1

    381ad582f72b30b4764afe0a817569b384be65a2

    SHA256

    027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

    SHA512

    40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

  • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe

    Filesize

    409KB

    MD5

    a131064868de7468d2e768211431401b

    SHA1

    381ad582f72b30b4764afe0a817569b384be65a2

    SHA256

    027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

    SHA512

    40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

  • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build2.exe

    Filesize

    409KB

    MD5

    a131064868de7468d2e768211431401b

    SHA1

    381ad582f72b30b4764afe0a817569b384be65a2

    SHA256

    027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

    SHA512

    40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

  • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\cbf5d713-f43e-4433-bec6-a0f3476c495b\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • \ProgramData\mozglue.dll

    Filesize

    133KB

    MD5

    8f73c08a9660691143661bf7332c3c27

    SHA1

    37fa65dd737c50fda710fdbde89e51374d0c204a

    SHA256

    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

    SHA512

    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

  • \ProgramData\nss3.dll

    Filesize

    1.2MB

    MD5

    bfac4e3c5908856ba17d41edcd455a51

    SHA1

    8eec7e888767aa9e4cca8ff246eb2aacb9170428

    SHA256

    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

    SHA512

    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

  • memory/508-482-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/508-582-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/1392-483-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1392-338-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2636-131-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-124-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-143-0x0000000002230000-0x00000000022C6000-memory.dmp

    Filesize

    600KB

  • memory/2636-144-0x0000000002350000-0x000000000246B000-memory.dmp

    Filesize

    1.1MB

  • memory/2636-145-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-146-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-147-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-141-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-140-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-139-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-138-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-137-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-136-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-135-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-134-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-119-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-132-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-130-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-129-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-128-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-127-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-126-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-142-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-125-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-123-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-122-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-121-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-120-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/2636-118-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/3492-271-0x00000000020A0000-0x000000000213E000-memory.dmp

    Filesize

    632KB

  • memory/4460-434-0x0000000002090000-0x00000000020E3000-memory.dmp

    Filesize

    332KB

  • memory/4696-183-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-176-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-179-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-180-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-181-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-182-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-173-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-184-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-185-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-199-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4696-171-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-169-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-249-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4696-170-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-177-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-168-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-167-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-166-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-165-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-163-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-164-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-178-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-162-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-161-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-175-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-160-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-159-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-158-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-174-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-157-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-156-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-155-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4696-154-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-153-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-152-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-151-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-150-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-172-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4696-148-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB