Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

231114-vxdw7sdg61 10

28/10/2023, 19:29

231028-x7cs1age56 10

24/10/2023, 13:29

231024-qrn3rsdb6z 10

18/10/2023, 12:04

231018-n8ybnaeb31 10

07/09/2023, 12:10

230907-pce1wahe2x 10

Analysis

  • max time kernel
    112s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2023, 12:04

General

  • Target

    81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe

  • Size

    1.1MB

  • MD5

    5b3c8242aab49db13a10b3454bf14ac8

  • SHA1

    9667f4b95635d6e464963b47a2b559ca8a6add94

  • SHA256

    81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9

  • SHA512

    4aa7493a8a978e67b3e7a6f2f6008b74ca92e7a2bf34846bec189180ffce1022c38b80af39d52713c36e026ff20c9e660c6f80157fc05de4c25b502f35a2be32

  • SSDEEP

    24576:mABwP/lOtVi7TlVvmgwdaeiQAAJLqnVd:5W4q5wg6HZJG

Malware Config

Extracted

Family

djvu

C2

http://dell1.ug/Asjd74ywuhodfgdfgpenelop5/45y87hzjdfg/get.php

Attributes
  • extension

    .boot

  • offline_id

    zZyLTRlsJ8hv1HPF6BPmiyHxTSON3B8vILboott1

  • payload_url

    http://dell1.ug/files/penelop/updatewin1.exe

    http://dell1.ug/files/penelop/updatewin2.exe

    http://dell1.ug/files/penelop/updatewin.exe

    http://dell1.ug/files/penelop/3.exe

    http://dell1.ug/files/penelop/4.exe

    http://dell1.ug/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-JeLOm18e5g Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0167A73uHsdfs89

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 12 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
    "C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 832
      2⤵
      • Program crash
      PID:1968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 840
      2⤵
      • Program crash
      PID:4064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 840
      2⤵
      • Program crash
      PID:2444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 872
      2⤵
      • Program crash
      PID:1348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 972
      2⤵
      • Program crash
      PID:112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 972
      2⤵
      • Program crash
      PID:2940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1524
      2⤵
      • Program crash
      PID:748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1624
      2⤵
      • Program crash
      PID:3176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1804
      2⤵
      • Program crash
      PID:4256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1648
      2⤵
      • Program crash
      PID:2716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1812
      2⤵
      • Program crash
      PID:3744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1840
      2⤵
      • Program crash
      PID:4996
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1784
      2⤵
      • Program crash
      PID:2324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1524
      2⤵
      • Program crash
      PID:4404
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\e91bb9ac-b20c-49fd-ae4b-b7c38fc947ec" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:2144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1540
      2⤵
      • Program crash
      PID:3492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1816
      2⤵
      • Program crash
      PID:1192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 2036
      2⤵
      • Program crash
      PID:3648
    • C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
      "C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 792
        3⤵
        • Program crash
        PID:4064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 812
        3⤵
        • Program crash
        PID:2444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 812
        3⤵
        • Program crash
        PID:1916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 884
        3⤵
        • Program crash
        PID:2820
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1000
        3⤵
        • Program crash
        PID:2940
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1088
        3⤵
        • Program crash
        PID:1260
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1336
        3⤵
        • Program crash
        PID:4936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1572
        3⤵
        • Program crash
        PID:4256
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1580
        3⤵
        • Program crash
        PID:2836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1668
        3⤵
        • Program crash
        PID:3744
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1628
        3⤵
        • Program crash
        PID:4340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1688
        3⤵
        • Program crash
        PID:3180
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1388
        3⤵
        • Program crash
        PID:2408
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1704
        3⤵
        • Program crash
        PID:1008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1548
        3⤵
        • Program crash
        PID:828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1712
        3⤵
        • Program crash
        PID:3280
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 2052
      2⤵
      • Program crash
      PID:1968
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2148 -ip 2148
    1⤵
      PID:3556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2148 -ip 2148
      1⤵
        PID:3784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2148 -ip 2148
        1⤵
          PID:3972
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2148 -ip 2148
          1⤵
            PID:4588
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2148 -ip 2148
            1⤵
              PID:3016
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2148 -ip 2148
              1⤵
                PID:2580
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2148 -ip 2148
                1⤵
                  PID:1236
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2148 -ip 2148
                  1⤵
                    PID:3636
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2148 -ip 2148
                    1⤵
                      PID:3892
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2148 -ip 2148
                      1⤵
                        PID:5040
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2148 -ip 2148
                        1⤵
                          PID:4548
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2148 -ip 2148
                          1⤵
                            PID:4872
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2148 -ip 2148
                            1⤵
                              PID:3620
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2148 -ip 2148
                              1⤵
                                PID:812
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2148 -ip 2148
                                1⤵
                                  PID:3936
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2148 -ip 2148
                                  1⤵
                                    PID:228
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2148 -ip 2148
                                    1⤵
                                      PID:2720
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2148 -ip 2148
                                      1⤵
                                        PID:4796
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3632 -ip 3632
                                        1⤵
                                          PID:4532
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3632 -ip 3632
                                          1⤵
                                            PID:404
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3632 -ip 3632
                                            1⤵
                                              PID:3716
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3632 -ip 3632
                                              1⤵
                                                PID:116
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3632 -ip 3632
                                                1⤵
                                                  PID:3096
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3632 -ip 3632
                                                  1⤵
                                                    PID:1520
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3632 -ip 3632
                                                    1⤵
                                                      PID:2856
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3632 -ip 3632
                                                      1⤵
                                                        PID:4372
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3632 -ip 3632
                                                        1⤵
                                                          PID:3996
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3632 -ip 3632
                                                          1⤵
                                                            PID:2628
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3632 -ip 3632
                                                            1⤵
                                                              PID:3148
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3632 -ip 3632
                                                              1⤵
                                                                PID:4440
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3632 -ip 3632
                                                                1⤵
                                                                  PID:3848
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3632 -ip 3632
                                                                  1⤵
                                                                    PID:1208
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3632 -ip 3632
                                                                    1⤵
                                                                      PID:3468
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3632 -ip 3632
                                                                      1⤵
                                                                        PID:1708
                                                                      • C:\Users\Admin\AppData\Local\e91bb9ac-b20c-49fd-ae4b-b7c38fc947ec\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
                                                                        C:\Users\Admin\AppData\Local\e91bb9ac-b20c-49fd-ae4b-b7c38fc947ec\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe --Task
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2228

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        4402a0fc0ec273e2c3bd6a1188700b05

                                                                        SHA1

                                                                        2c8ff24692967b5ae6a2b827113336b51bfe59d6

                                                                        SHA256

                                                                        18b75f28d4760e6da2dd7a54f388dfa8576e124acee9fa1127b0ad7be52c51b9

                                                                        SHA512

                                                                        fc105e88cc8c5a785914a2eb6920e4b648db2332e1984e3f61f396562229e89f6a6200859868419664cc5436750a0014934102e618088ccf7c270c13d60b9abf

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                                                        Filesize

                                                                        724B

                                                                        MD5

                                                                        8202a1cd02e7d69597995cabbe881a12

                                                                        SHA1

                                                                        8858d9d934b7aa9330ee73de6c476acf19929ff6

                                                                        SHA256

                                                                        58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                                                        SHA512

                                                                        97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                                        Filesize

                                                                        410B

                                                                        MD5

                                                                        3949c28ec596f1c065176f403255fd51

                                                                        SHA1

                                                                        c343dd4b485fba9fd820a40424250898b4d033c7

                                                                        SHA256

                                                                        f56192dd9eaca67f513d8dfb5054c00d345e4b041324e57b2b66b4faa69ac232

                                                                        SHA512

                                                                        03e93d4dfd2f05f7429f941003c31072bc8604cfc4ae23d64c7d08c6fd2f2bd9b9d1b1b6db739fe86fa2d1c6baa2480971d170871e5ab6c1fc595a639506413e

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                                                        Filesize

                                                                        392B

                                                                        MD5

                                                                        ac6eea1807c4a2d251a9ef787803bd64

                                                                        SHA1

                                                                        0b3140084583c0dd4c5b0df69e703ff395e9adb4

                                                                        SHA256

                                                                        a6b1fffece4e9e9ea365f0530e3857f922669511b263b9d1a46b27f63ce81bd0

                                                                        SHA512

                                                                        ea745f93c43f54d14f31f53932c455e08bb43ae8276aa5a902bdc5d37335811a3d257bbc5db1fc3f96bed4fbb14996eb9a3cc338acf66c675ef4ee77af7f2a13

                                                                      • C:\Users\Admin\AppData\Local\e91bb9ac-b20c-49fd-ae4b-b7c38fc947ec\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe

                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        5b3c8242aab49db13a10b3454bf14ac8

                                                                        SHA1

                                                                        9667f4b95635d6e464963b47a2b559ca8a6add94

                                                                        SHA256

                                                                        81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9

                                                                        SHA512

                                                                        4aa7493a8a978e67b3e7a6f2f6008b74ca92e7a2bf34846bec189180ffce1022c38b80af39d52713c36e026ff20c9e660c6f80157fc05de4c25b502f35a2be32

                                                                      • C:\Users\Admin\AppData\Local\e91bb9ac-b20c-49fd-ae4b-b7c38fc947ec\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe

                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        5b3c8242aab49db13a10b3454bf14ac8

                                                                        SHA1

                                                                        9667f4b95635d6e464963b47a2b559ca8a6add94

                                                                        SHA256

                                                                        81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9

                                                                        SHA512

                                                                        4aa7493a8a978e67b3e7a6f2f6008b74ca92e7a2bf34846bec189180ffce1022c38b80af39d52713c36e026ff20c9e660c6f80157fc05de4c25b502f35a2be32

                                                                      • memory/2148-19-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/2148-18-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/2148-13-0x0000000000CA0000-0x0000000000DBA000-memory.dmp

                                                                        Filesize

                                                                        1.1MB

                                                                      • memory/2148-20-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/2148-9-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

                                                                        Filesize

                                                                        824KB

                                                                      • memory/2148-0-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/2148-4-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/2148-3-0x0000000000CA0000-0x0000000000DBA000-memory.dmp

                                                                        Filesize

                                                                        1.1MB

                                                                      • memory/2148-2-0x0000000000BD0000-0x0000000000C9E000-memory.dmp

                                                                        Filesize

                                                                        824KB

                                                                      • memory/2228-38-0x0000000000C40000-0x0000000000D0E000-memory.dmp

                                                                        Filesize

                                                                        824KB

                                                                      • memory/3632-24-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/3632-29-0x0000000000C40000-0x0000000000D07000-memory.dmp

                                                                        Filesize

                                                                        796KB

                                                                      • memory/3632-30-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/3632-33-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/3632-34-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/3632-35-0x0000000000400000-0x000000000053B000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                      • memory/3632-23-0x0000000000D10000-0x0000000000E2A000-memory.dmp

                                                                        Filesize

                                                                        1.1MB

                                                                      • memory/3632-22-0x0000000000C40000-0x0000000000D07000-memory.dmp

                                                                        Filesize

                                                                        796KB