Analysis

  • max time kernel
    298s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2024, 04:49

General

  • Target

    259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe

  • Size

    759KB

  • MD5

    d48a1bd6a8c7321c8d447fd758269109

  • SHA1

    29d0ae4ebff272319315646796804308fe768094

  • SHA256

    259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c

  • SHA512

    86e6e8df9810f1a80a2dc84f66575ca7cd81e0971951d3f591ce5e848e94fd57077878a297e2b60288034f7f4d5769962e195684d4fc441037add04ef7680d68

  • SSDEEP

    12288:y3UWSeAZaZ+wbClkh5PO3f/sZqqt08BJqrUf40wb15PO0/77he:hWSeAZSL7sH8qqt08BE0S7POme

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
    "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
      "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:660
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\e7d28f56-34ff-4120-a059-484b3944e21f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2556
      • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
        "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
          "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1984
          • C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe
            "C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2844
            • C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe
              "C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2016
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:2724
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {712143BD-0B46-47E6-B63D-EF6FCB6F3458} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1100
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1392
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        PID:880
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1568
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        PID:1608
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1200
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        PID:868
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:696
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        3⤵
        • Executes dropped EXE
        PID:564
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:1724

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          b7470a9aa569b259d4c2bb3b80ae3aa3

          SHA1

          093290296b7f1e402ef96e4b33a88f064aa401eb

          SHA256

          ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

          SHA512

          4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          6462ee0f7a0fc96b728c1ad537f2faa3

          SHA1

          961e9026b6b729d5e231cecc5dbd3bf0653dd28f

          SHA256

          e7d61da0ca85f3c7d05f482ac7ad1b6da568790d7f87cc18301b974cf3bc4f72

          SHA512

          a81c6fc50fc8f8b34d61a799743727d5bcdb97543db8936b0c6837c0f9c6e23f61e1f05cbaff09fb039b4575e013d1728a8256c7bbffeba7ef803ef4b398f8a4

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          de8ab5a0d13b7007771a47c4b70435db

          SHA1

          6efb6a986fc2e5d9855a6d3b47e11b705fe73b40

          SHA256

          0a1736a8697114857fc3fa89b58229e2251b97db5a2bf34f76941d10d2f8e43b

          SHA512

          c1ffe5efcad8e1d477a22720c811953ca2ee877739dbe2ec4021747358707e48bd4180df3fa6ffe09d43f0583ff0ef21941ab49e8feedc8bc871d12315879f53

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          eab19fd0d019757c269c843cb85a3a3b

          SHA1

          4c798d97a9e9c482c8d3c4e4c0706296fb35bb80

          SHA256

          d7f27496fc56cbc5ddbbd4cc9f7c4d4b47a443890dc9e68ab3961c9d91dda7e6

          SHA512

          2de5077e13cf0a4eb672aa95a0354b199c9ec7e9d5142e63222f3d0e7b956723212dd19432bcae8fc832b6eb4c8aed9f399c4feaa03670e885856ca7f89b1092

        • C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe

          Filesize

          61KB

          MD5

          eeea38588fb7779b64a08d697de74b2d

          SHA1

          a14a07e264f2699ca081fa236569e8803fcec7ef

          SHA256

          bffba33f245f868351ba0b86ddbecda64e5b57aefd153918d777fbf910b5b00f

          SHA512

          77c123984ceffcedbdc9e6eb99dd3918071ddc0e1d2eff1ebdff0e182230f141ad5f8ca339a63cbe6189c7e623b356b9d9ae4c9bbec9d53becd27bf61eed6b16

        • C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe

          Filesize

          76KB

          MD5

          22f566a6872db475990f49438cad2f7e

          SHA1

          a34d58ea8f06a349499ab2fc98618c295b1ee647

          SHA256

          382f7f2614d7dbb9f04869de5299c768fcff9c62f9808c5c14a6a822b2924b74

          SHA512

          b27baa18c577bdecdf8cede0ac8d6ce1e00f5b68c8e4d4e96010e2b66437e9eabff04140137468f64a18510e5faf3d7de1a761eab8d8361bfbdc9c711c2aacb8

        • C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe

          Filesize

          22KB

          MD5

          9da9fcbf2004bd6e092e999264c9dd70

          SHA1

          c17d53b3e1955b92a83e610765080b8c0e1f8051

          SHA256

          32bfabee3c5bfa62a18c1775cd9240dd91769278a81d75896a3127ebcb626726

          SHA512

          7a695a9f4dc6e4e2b206c5661fb0dff98f8fff4de076ccb2945d6b234dc272f7ff55ca2ade49d0ca60008bc1a66bdbc044ddeb37abe5e8a981026c2ada5f3504

        • C:\Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe

          Filesize

          85KB

          MD5

          c14d3c1daefc7e9e61f4f3ecb196a072

          SHA1

          bee055bea9fef82d9cad9048a33cc1846fff8fb8

          SHA256

          75ebcfcd9ff6016bfa03591fe7eb04c86e022083f7a95321b69bc10a68719855

          SHA512

          bcacb8f84e405362260f3eec93bbccb37dc45f15117f7e2388dbc6a8133d1b50fc89e95f12a88fd450681391a9f2eff8ef1c06e18cb1e1182f764c3a6436fe47

        • C:\Users\Admin\AppData\Local\Temp\Cab54E4.tmp

          Filesize

          45KB

          MD5

          dc38d629e51926a750b443772d7c8c65

          SHA1

          2868765523e76b2e6706f18ecb665f4631a00d00

          SHA256

          21a98ea45d4ca76fc03cd769b01345da379395b41295e1506644149d0a378883

          SHA512

          beb8198332e8771a0475a925a4b31a8a80df9a04dc889442d1a4e024b1b66709acc3e347d50af1868d5d0c351d489cd454fc2523f752ea9dec56b9a9d6048ef4

        • C:\Users\Admin\AppData\Local\e7d28f56-34ff-4120-a059-484b3944e21f\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe

          Filesize

          178KB

          MD5

          d51a96b944ce06d2e91d5f61ad34a0a5

          SHA1

          b72b5aa08803dfe2e63910bee28abefdd33f285b

          SHA256

          22be52ae77a44f9e67be35946a244e21f9bea945d066e2b0f45007d638cb5c64

          SHA512

          bae681b1e3696d6eb2b3f26f4f984a076d369e6350dd4c9de19f2b13562ca2df7a6c533423f872a401f63140114570a7cff901cf86fac31cc72c87d1cc914262

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          51KB

          MD5

          e9831ecd7df9b3c3c426897bc93cc9d5

          SHA1

          88f3641b08b040734c83589bf2436fee926d1f2e

          SHA256

          f8cd0322bac1b1e1a04d1b4be1a4e893792090fc864bc3ea51d78e6b98f99ee4

          SHA512

          9fa0d9261fda5a373306ec09b0e6597659437c9fe8dad8f0722b63de45a05e0eba2f85cf2f046778334668ec095456b24c57d48a9db7ef3ac98e298c4b53af02

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          137KB

          MD5

          967e39a49e4faaad6896141a43ad9f52

          SHA1

          a6ce3181fc8e5fdcfdced9d0d1d12701565ca2f4

          SHA256

          76c29f45967335894674f3833a039731a2adbe4fee70308d41fd5388a474bd66

          SHA512

          1c72662c4a67654189c833adb289b5bf9e1ec565e2caf596427dcc819ee9aed40a542fb25ec0a27688f7a6799359d1259897e805d8b92d66caa0ba35737d184c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          170KB

          MD5

          dde36f65adfd1c6a0c3c1957265fd03a

          SHA1

          6381758199ddb003739da7dc95145628cebef393

          SHA256

          b45104ab4ed7b174859b33240dbb47344faa5789844f72be44397dcb063329e2

          SHA512

          8a4a8880a769dcac006dc83dd0e04b5d6e3273064340f461d57015a460b2dc24061c73e660e120bef049f43173d88a0c9af27e044af67c0f17a7504b1c546378

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          170KB

          MD5

          4f4cc162cfdee11dcae198a4203b9076

          SHA1

          3a225cacb10541f7f7b006565c48dc0abcc1e335

          SHA256

          fd4c1b8daa70eb8fc728ca5054af55992048862b67cc2983b6d538eb34d80342

          SHA512

          1f2ccedaad2838f4eacafd08212fadffa81a1f38c022253a1fddee771347557f2c57fc13a714d19f96f64f11bea250c5030a73debb68e60d3983bcf636c7beb4

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          161KB

          MD5

          8fba0ecddc1f7635ee45247a0e021f9b

          SHA1

          7a430a8fa16ea782f0d8f426b458080a4ffc7bc5

          SHA256

          4b4248693138f01288b2204b9833ad2ddce5649c8b1bbcfa4b3b6699b3633f52

          SHA512

          7ef100331fe10a9e3c677ea548196de292568c6cbb253c9b11b43eeabfc43837dc0ce1673d47c4308c2f3f212b84c2846b92cd0b379cde3352626cd38450da30

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          299KB

          MD5

          41b883a061c95e9b9cb17d4ca50de770

          SHA1

          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

          SHA256

          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

          SHA512

          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          53KB

          MD5

          9ff59ea1d59b4c977ecdf579de18781a

          SHA1

          37412c5635ea4180957984d0ac8dc5819463f82d

          SHA256

          1cb305547cc2d78483cb2ce3d481620428767cd1c44e409f5cf90aeda9c47f5a

          SHA512

          b5c52cc8040ba74d577b261f12b6382180db71797aa4a39a6a96b25ada98025be3616381684f839806f62a36b62fced08edb5ff1e7829c5bb2301dd5f56e4b42

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          92KB

          MD5

          4b3fc3105731c7ff3a7e3966416912a2

          SHA1

          0e792bf25e8795158074fa6bd2ee87ad16675124

          SHA256

          c0f698bcc4324958848de5d8e1b1bdaed5e01632d8c827a5a95356eb04a2c443

          SHA512

          6ed5ee0139d9d9a676232a6c5d6e9a8528f880025a11fccf8a1a32a999ae5fac41f993c384fabec788e4e47da714d67f1def0348da6b0f4392e7fc7ff1098c28

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          151KB

          MD5

          259d74ac1403a3e2144e23a3050d610b

          SHA1

          cc632aa69a799b422e0faffdde605ec78d9bb310

          SHA256

          211f13c11f4281bc844099836f0dd38807826c76dac057e3db7ab6fdeeeef51b

          SHA512

          698113e9488202c8ea8c4b14be9b3f4ccd281bc11c364bc364222ddcfe412674fecddf5e5200407eb1e051fc3a3cb7bfd12a3ac4c2a59304ad59e5ff73262fa8

        • \Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe

          Filesize

          6KB

          MD5

          69b5f96804d63beab43c4690cf109814

          SHA1

          be39db1c3c32b8add8783d90e17a54263883425f

          SHA256

          88f5a9b9c8916ef65ecf53cd0a9e110261b338334acb09579e16f982be253ee8

          SHA512

          5d72442cef0c778dcddb78751ec1999318930c1d16a88ee963e781572e09d9237339a9fe3fcf67e1fd0fc5638d084ba53e01363af8684eae5bdfcca244164123

        • \Users\Admin\AppData\Local\9513b4d3-5698-45a8-b68a-f952a34d29ef\build3.exe

          Filesize

          64KB

          MD5

          8b6a819c6926597dfa7529b692d7a6cc

          SHA1

          50c535e9cca464afd3a589d2231d87ce417d4312

          SHA256

          b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c

          SHA512

          dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9

        • memory/660-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/660-5-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/660-26-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/660-7-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/660-8-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/696-184-0x0000000000870000-0x0000000000970000-memory.dmp

          Filesize

          1024KB

        • memory/1200-161-0x0000000000312000-0x0000000000322000-memory.dmp

          Filesize

          64KB

        • memory/1232-4-0x0000000001D50000-0x0000000001E6B000-memory.dmp

          Filesize

          1.1MB

        • memory/1232-2-0x0000000000540000-0x00000000005D2000-memory.dmp

          Filesize

          584KB

        • memory/1232-0-0x0000000000540000-0x00000000005D2000-memory.dmp

          Filesize

          584KB

        • memory/1392-118-0x00000000002F0000-0x00000000003F0000-memory.dmp

          Filesize

          1024KB

        • memory/1568-139-0x0000000000952000-0x0000000000962000-memory.dmp

          Filesize

          64KB

        • memory/1984-69-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-49-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-54-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-50-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-35-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-36-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-56-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-57-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/1984-58-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2016-81-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2016-83-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2016-76-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2704-29-0x0000000001D30000-0x0000000001DC2000-memory.dmp

          Filesize

          584KB

        • memory/2704-27-0x0000000001D30000-0x0000000001DC2000-memory.dmp

          Filesize

          584KB

        • memory/2704-34-0x0000000001D30000-0x0000000001DC2000-memory.dmp

          Filesize

          584KB

        • memory/2844-78-0x0000000000220000-0x0000000000224000-memory.dmp

          Filesize

          16KB

        • memory/2844-96-0x0000000000220000-0x0000000000224000-memory.dmp

          Filesize

          16KB

        • memory/2844-77-0x0000000000C30000-0x0000000000D30000-memory.dmp

          Filesize

          1024KB

        • memory/3004-90-0x0000000000880000-0x0000000000980000-memory.dmp

          Filesize

          1024KB