djvu | c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6

Analysis

max time kernel
297s
max time network
239s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
14/01/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
Size 810KB
Sample240114-2b7qqaecg6
SHA256 c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6
MD5 07afa7fb45fe53d165679586b77be770
SHA1 a4065fbfaa0d0344983f5eaa760504845cdc8f87
SHA512 a47911bd2fdbb476c9ca96a253f9737411f562185da9f064b6698994cefe9f34187e29ba3be315a2abfba7ef746aff2aaa8b1bda793b4c89c918b6665ef66440
SSDEEP 12288:2xkismkgVjrrwdGmfO/SYQiU9By6FKhQseDMqfnu+qcspmi177gJzWF:wkgVaGwO/xXUPy6ohdeAqBqc7z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu vidar discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://zexeq.com/test1/get.php

Attributes

extension
.cdwe
offline_id
dSwr1XNNi5cIitB5eDPbMANcusB1dWGDB8ToUnt1
payload_url
http://brusuax.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-e21iz7dS58 Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0842ASdw

rsa_pubkey.plain

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/3852-44-0x00000000006F0000-0x000000000073B000-memory.dmp	family_vidar_v6
behavioral2/memory/532-45-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral2/memory/532-43-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral2/memory/532-39-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral2/memory/532-51-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6

Detected Djvu ransomware 17 IoCs

resource	yara_rule
behavioral2/memory/2156-2-0x00000000026A0000-0x00000000027BB000-memory.dmp	family_djvu
behavioral2/memory/3620-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3620-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3620-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3620-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3620-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-46-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-54-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-56-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1788-57-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3852	build2.exe
532	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1412	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3934047325-4097474570-3437169968-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\445b27b3-d7d1-4b34-8bdb-13c9cd7dcdfa\\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe\" --AutoStart"	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.2ip.ua
1	api.2ip.ua
2	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 3080 set thread context of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3852 set thread context of 532	3852	build2.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	532	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
1788	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
1788	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 2156 wrote to memory of 3620	2156	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	74
PID 3620 wrote to memory of 1412	3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	75
PID 3620 wrote to memory of 1412	3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	75
PID 3620 wrote to memory of 1412	3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	75
PID 3620 wrote to memory of 3080	3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	77
PID 3620 wrote to memory of 3080	3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	77
PID 3620 wrote to memory of 3080	3620	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	77
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 3080 wrote to memory of 1788	3080	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	78
PID 1788 wrote to memory of 3852	1788	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	80
PID 1788 wrote to memory of 3852	1788	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	80
PID 1788 wrote to memory of 3852	1788	c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe	80
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79
PID 3852 wrote to memory of 532	3852	build2.exe	79

C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
"C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
  "C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\445b27b3-d7d1-4b34-8bdb-13c9cd7dcdfa" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
    "C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
      "C:\Users\Admin\AppData\Local\Temp\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe
        
        "C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3852

C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe
"C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe"
1⤵
- Executes dropped EXE
PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 1864
  2⤵
  - Program crash
  PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 0da3f6452b91947ed4ad5e11a34cb348a7da0276e2ee8f8f27d5f3b3987dd1bd
MD5 3b8718bd7867f0d32922fc6eb112e52f
SHA1 f2667fa1606dbb70afd3a265a94badd166cf84d6
SHA512 547ddb54df5a51317868ba80164c05e706d0e8900a1db228af4c5c3cb4297e2fe4ecd65a67d83eb797c23217cb1246f07bd3848b5c97b7c7df37ee270e93ebd7
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 97b664062a4882896e4df7071dc5e844da2415cce3b114086e45c6be8b17b5fe
MD5 5b3a85309da9fa17b1f927f36e63a476
SHA1 d96f1f57172b581520dbdd63c76f7d4a51d26583
SHA512 262e20b1b4bb1d406e8b4feef76ccde07ade705fa93a2928289733b0de6ac069ff36139252b39c150e2d3ecfa63c152744594ee6490184ed1935192da7adc3c9
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 d20083343cf703ef1871a31a8936e0fa219394d0dffbe5583b2e1cc8b0294bd5
MD5 399eb768fab894aacb2ff3a3135f0a58
SHA1 4159194981d14c3414241c22ea747ed37bee23f8
SHA512 acc709d0980aa34234c1a88beda6597ff5d35f4fe3dd1973a9273fb7c1f63223310bd01c77da07f77a81b6d3ea41ad2bb8f6808c52d9ae36c570bf2811df3c1a
MD5 SHA1 SHA512

Submit Download

c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe

Path C:\Users\Admin\AppData\Local\445b27b3-d7d1-4b34-8bdb-13c9cd7dcdfa\c02005305c2ccc9e74c9a43ba13aadaf32b07e6af5b1620172ef47ee798fc9a6.exe
Size 1KB
SHA256 372b2c78bc949cf83d0af57d1efed44dbb657251836362c216498875ffd252f2
MD5 d7ca20326ae9ae24070e72b9dc50685c
SHA1 d14c09d75272843df33d84903d8c6c344e3314ba
SHA512 13d05cc101f46d9ce09bf8ae1b95bd9bdf392d5c8f3f4a245093aa513415525b6c2c7f4524872e675715edfc9b35557a2252cc4ece2bec19cb62ce1cda607a95
MD5 SHA1 SHA512

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe
Size 227KB
SHA256 75cc156a4b8c94fccc0de0b848f3b94f5591a94a261d14009db1686ce3d54785
MD5 3962f259c7ac7d86e6a151e73228137c
SHA1 2e229eddd3f3ee4f08378bc53795add0dc88ba38
SHA512 2c86d82fe4475c28a75d48ddf484c666980e27332046db5e797721f9e68f7b3807e1d4f648bf2fee6fe875e7c46db5562a078224de9b12ce382d7a2fa1c3b76e
SSDEEP 3072:paxQLapbXGgtyhJiK61Ko+Eknjw15ZPVcu8l3EmzjkvjW4VTR1gagQAp3TXd:pfLgtyckjU51Vc7lLUvTlR2agQAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe
Size 294KB
SHA256 e0d6c51df144a7a04b4cd5fbcd5d648c999418aedae357c161e1f818746349fb
MD5 acfc4392d38fc420425a54a8ace6c030
SHA1 b4b03adc6b5e7055bbd986aac0ecd641e5b614be
SHA512 96e3b330c2076d3a2562c6ef84106e0ddbc305a8995baf519395989add6140121c8060cfb9a78f3efbdb1d8899a4a97f262e5f892724fa28754d795aa788a41e
SSDEEP 6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSn:pfMtycGU5/klLUvTlR5Aiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\79f551c3-e1a2-41e6-a616-6469460e31f0\build2.exe
Size 137KB
SHA256 98d7524c5cae301073a5b2dc83ee3f3094537b49d0d8bfad31e0e1657645c739
MD5 d0a332c95c214162200bbded95d1e1df
SHA1 55312d17663294d17a1b9dd6d72d56286c356458
SHA512 c95e9e253cbf8ab62e92b3153c8e62cc6e5255230179ce66cee26609b50f60fe22c2617c5813d4ecf59c19cf8bb282364ae94a1aff50bd42218ba02157d825bf
SSDEEP 3072:paxQLapbXGgtyhJiK61Ko+Eknjw15ZPVc0:pfLgtyckjU51Vc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-51-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/532-39-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/532-43-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/532-45-0x0000000000400000-0x000000000065E000-memory.dmp

Download

memory/1788-24-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-54-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-23-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-57-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-21-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-30-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-56-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-52-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-46-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1788-55-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2156-2-0x00000000026A0000-0x00000000027BB000-memory.dmp

Download

memory/2156-1-0x0000000002600000-0x0000000002698000-memory.dmp

Download

memory/3080-22-0x0000000002490000-0x0000000002521000-memory.dmp

Download

memory/3620-3-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3620-4-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3620-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3620-6-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3620-17-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3852-44-0x00000000006F0000-0x000000000073B000-memory.dmp

Download

memory/3852-42-0x0000000000520000-0x0000000000620000-memory.dmp

Download

memory/3852-59-0x00000000006F0000-0x000000000073B000-memory.dmp

Download