Analysis

  • max time kernel
    1s
  • max time network
    250s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:49

General

  • Target

    259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe

  • Size

    759KB

  • MD5

    d48a1bd6a8c7321c8d447fd758269109

  • SHA1

    29d0ae4ebff272319315646796804308fe768094

  • SHA256

    259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c

  • SHA512

    86e6e8df9810f1a80a2dc84f66575ca7cd81e0971951d3f591ce5e848e94fd57077878a297e2b60288034f7f4d5769962e195684d4fc441037add04ef7680d68

  • SSDEEP

    12288:y3UWSeAZaZ+wbClkh5PO3f/sZqqt08BJqrUf40wb15PO0/77he:hWSeAZSL7sH8qqt08BE0S7POme

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 19 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
    "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
      "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3752
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\fc7c7492-46ca-4ffe-a76a-dee17d408988" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4876
      • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
        "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3460
  • C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe
    "C:\Users\Admin\AppData\Local\Temp\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe" --Admin IsNotAutoStart IsNotTask
    1⤵
      PID:664
      • C:\Users\Admin\AppData\Local\2af8329d-97db-412c-b7b8-ee8aad40aa0e\build3.exe
        "C:\Users\Admin\AppData\Local\2af8329d-97db-412c-b7b8-ee8aad40aa0e\build3.exe"
        2⤵
          PID:928
          • C:\Users\Admin\AppData\Local\2af8329d-97db-412c-b7b8-ee8aad40aa0e\build3.exe
            "C:\Users\Admin\AppData\Local\2af8329d-97db-412c-b7b8-ee8aad40aa0e\build3.exe"
            3⤵
              PID:1276
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          1⤵
          • Creates scheduled task(s)
          PID:1500
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          1⤵
            PID:5088
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              2⤵
                PID:5084
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              1⤵
              • Creates scheduled task(s)
              PID:1316
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              1⤵
                PID:3860
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  2⤵
                    PID:4796
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                    PID:932
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      2⤵
                        PID:3796
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      1⤵
                        PID:3420
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          2⤵
                            PID:1064
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          1⤵
                            PID:1992
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              2⤵
                                PID:3180

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                    Filesize

                                    1KB

                                    MD5

                                    b7470a9aa569b259d4c2bb3b80ae3aa3

                                    SHA1

                                    093290296b7f1e402ef96e4b33a88f064aa401eb

                                    SHA256

                                    ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

                                    SHA512

                                    4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                    Filesize

                                    724B

                                    MD5

                                    8202a1cd02e7d69597995cabbe881a12

                                    SHA1

                                    8858d9d934b7aa9330ee73de6c476acf19929ff6

                                    SHA256

                                    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                    SHA512

                                    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                    Filesize

                                    410B

                                    MD5

                                    9cc1977b23fb385caa5defc738fa074e

                                    SHA1

                                    9d3ee63d8333d4414afceee9c8e15c4e1411df2e

                                    SHA256

                                    befbd5d5a22aa285c37b6eff8673c6e04219f427ee42169dd38508066baaa1fe

                                    SHA512

                                    f6ddaa523c854fe02d93052aad56b00462d86a5b226a181b7cc94cbbc3b264d817162b7ed12047bf2338cdca6c982ae5d327ca3f77ea021b92613591b1157ec6

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                    Filesize

                                    392B

                                    MD5

                                    3c3a63faadf555ee93bf2e83b6ebe1fe

                                    SHA1

                                    3498135e68f00fc3c97c65003771c73b1fc475e1

                                    SHA256

                                    3e20395d60b0a6ad75ef8a1156838ef1abca10c292347a617de72b1226065f35

                                    SHA512

                                    25b0e8736e644c87e52f12c6ceaf9bb5911af909236ea65091a13312edd20b7dc036b58d775ddee575ae4a74473709d0f3b77cdad9c10fe3ed2794aa7762fb13

                                  • C:\Users\Admin\AppData\Local\2af8329d-97db-412c-b7b8-ee8aad40aa0e\build3.exe

                                    Filesize

                                    3KB

                                    MD5

                                    341600276b87f80e07f34f1b6c8038bc

                                    SHA1

                                    67d4c4e81d7e85ea013ba02d8e29ef5ce67d50b8

                                    SHA256

                                    653cd9ed62bf0ee54e1a48c33705c9598e9da24a23bd751071c58f905699b76e

                                    SHA512

                                    46f1e26856a801de8815598c3d2fdc5945e911227824b7996e61d7c049e3ae23c86374d0bba7099ee6623f57712bd565cc13df3bfc21924cdec0be48e9f18083

                                  • C:\Users\Admin\AppData\Local\2af8329d-97db-412c-b7b8-ee8aad40aa0e\build3.exe

                                    Filesize

                                    17KB

                                    MD5

                                    e8c37ac0c4dd6c1450b8c08d873773fd

                                    SHA1

                                    49682bcd7d080ea60c34b932c32d8658f7bc7f92

                                    SHA256

                                    dc91b0d0c8fa8e706a86e4f527db028cbc57add4a18a9dc37e181d6bed9ee0f9

                                    SHA512

                                    2050a2d55bbd73aa97b6db510bf7646093249bff375284238f8c123a52abb25aa870c17fde69c962ceca4251d3e9bf364077143da385456d1dfcf88cbe75fa18

                                  • C:\Users\Admin\AppData\Local\fc7c7492-46ca-4ffe-a76a-dee17d408988\259c0c3e8fdad5211cb7a1998f13421e544f93f6ad8238b81f53fca45a141a4c.exe

                                    Filesize

                                    88KB

                                    MD5

                                    895cb14fd41a22e2308a95263ec9ff7b

                                    SHA1

                                    a8f7867c654290071d0d0398bb6b1c83e8ea38c0

                                    SHA256

                                    8c3aa8c0f81bd55e0bd9a58cdff549d9a45cc1330119a327159c7255a33739b8

                                    SHA512

                                    f7402cfa6a5e44ec118d14c43c0850ca6695aec590d05361a9611be905e10e1145be98ff2011ddfa3ccd3ea83e555724cea8f6ce021572e3dbe72f091efe5f77

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    69KB

                                    MD5

                                    d3c0700242c3bc72c9b415fdb361b6d3

                                    SHA1

                                    47c0df71abd59089bdd208ed2b4a1089cfb2559e

                                    SHA256

                                    62b924149af8b528b16c28c6d9f26fb5fd657b57815a7210d143a49561273584

                                    SHA512

                                    87ed9f82e91a38f72b32a1e0d8c7c0349613f115096812ced2dcf2aa2b716e9f386b4913b1cbc843dcc76c71e505380f734830f58c2c83039a1011316b3d1183

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    37KB

                                    MD5

                                    a9f1932ca79889a71338ade9e343889b

                                    SHA1

                                    d72870980c6f7ebed5a1cd32fc9227fe13fcc8b6

                                    SHA256

                                    977b1d6d3c599c7e22f1714b78b0268c97204783b06357d47737e33ec1f93469

                                    SHA512

                                    e425d60b4bd32684ec962de8436d49d01d7c9bca2cd05559b5d0110c2f7debea35ef74af9f3b76b4e50a509feed53fc8c49b08f2b647ed5c8f78914baf877b1d

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    1KB

                                    MD5

                                    d35c806c95b926208b06f305860de044

                                    SHA1

                                    fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b

                                    SHA256

                                    722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061

                                    SHA512

                                    cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    68KB

                                    MD5

                                    b3087de634ee92a4bcea1f514761f285

                                    SHA1

                                    e0b309fd3c6031c23353de3377956c1701fb84c8

                                    SHA256

                                    663bd047fd9fc486b61d488102b158d9773a718d56181a163173cb246547127f

                                    SHA512

                                    02f17c22d320d90e3e59871b9e708e53d897381119c482cf44f5fcb858e70a3162c314b677fee8ed493fe21d5af6369847fbc0c9aec54c4a10a6739ed4b151a6

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    28KB

                                    MD5

                                    ba36023bd75f597a13ac91b1bc9acab1

                                    SHA1

                                    9cca1681bcafff14cb8c016e76d5e06112f3035c

                                    SHA256

                                    a1fb686ed2519dc1a022858f188866ccce15bb17a3b8d8861bab558404d92f8b

                                    SHA512

                                    20d94aaf2f687e6db080267567486983daf34acc2c5e533358ff997a3ce9b64206520b400b662948289e9d6a5a60301da62f53074d62ba899c16255206c5de63

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    5KB

                                    MD5

                                    9b68e88a96e9bd56293f4c8b39314178

                                    SHA1

                                    a510f7c3d8783d7b8c1335d648cabe70db306840

                                    SHA256

                                    73e41876c3fdb962cd993c53d72b055fd7554669bfa8a9ed0de2621cf92f6052

                                    SHA512

                                    181322e7bb160f4a6945b5cbc820e39f1ae29e84b9b60bd64e942d9f281f4599e709716bf80ec54b6c39f7f4e3d6d28ec321970ba28617af8027189951eab513

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    21KB

                                    MD5

                                    5b6805ce19a9d692775fdcf07621fb90

                                    SHA1

                                    fa41add6cf3aca32261d05bed20f4d1c4c4e7753

                                    SHA256

                                    c10230df14526df0bd2c32e83770bc344a69b6806c39657d365b35dc69ffc203

                                    SHA512

                                    c976b03cdd951da99e831ada7023a8918f36d0435c2009d9309374ec8d2181239f12bf339c5d07b3cd00ae4fadf3846bbf441c8619beb46c5785c8b3f16671bd

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    65KB

                                    MD5

                                    67e826443af0cdc24b8af2c6bc534399

                                    SHA1

                                    0109f1a4fd0cf4e1a5c3527330043474e57958a0

                                    SHA256

                                    e8aa30d33d12822ca96df7ba8ca952dea53d6cfaf1d47035e57b3a5cb790573f

                                    SHA512

                                    138b878dba5ba66b8091ba277585c4a426f0ce553ddcc0f1c8baa79c513d729d3714d51cfe243d9bc468ba669a1299458a887dd7c8dbe236c138af202404d640

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    86KB

                                    MD5

                                    59892a39ba2b2717aef3c019564097b1

                                    SHA1

                                    342361c03743020a822d72d5509b6bb270765789

                                    SHA256

                                    925b8880fa83170f3838abbb18c9a6106de9c17801e215cfe963fe0dbff362fa

                                    SHA512

                                    23e23f539fa933ebd2d9aa08666af298f19da820c10039c56a2c25f62aa958ad7c56d00421d1bb9e39847ec4d331f7584b9d6a7a79112a5bf0f84cac126b9378

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    89KB

                                    MD5

                                    b05cd04bc58650a405cb7c7d8d6fa373

                                    SHA1

                                    4d02eb24b7ee9ba78a8f40fad17528a280c3f0e5

                                    SHA256

                                    e0c09078814869d10d681165dad8ec40757fdcaefd16a86a500171db1ef1de55

                                    SHA512

                                    8f26cbf34f95084f94ae07976ad05cc85fd26e5d61084adbafdd950d04316f09781ea3fbe5db06e11acc3f00f78db964b2cbcf7f4bbce3d104e6e6fd16856186

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    25KB

                                    MD5

                                    a11428adbd11e433a8f87cc5095c090f

                                    SHA1

                                    df903c7aebb264282ecf0071b28f11ec2901a59b

                                    SHA256

                                    0410d150f7d6670d35dce7f9522d6fa8f49ca0adb6a04e730842e9791b2d73ee

                                    SHA512

                                    3cb47f45fc7f9e7e7219081f2da4793ebf2101995f4538877d9c2dbeb827256d8d29e5873c497ebad3e0d824dc5fb3d86ab3cb08d335b3ee57fe5f275f8b87c4

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    43KB

                                    MD5

                                    f90b73a4871f8f947904cf1d64d6f843

                                    SHA1

                                    fb842fa3ef0423d5c11304f162ed8810143169c7

                                    SHA256

                                    26a2d08de06f31db8058b4599d182f3965572a44bf17e8a7409a711135dadcef

                                    SHA512

                                    0624012e75210b1148732f00f75c306d35f3d814c1e34ebc34035f1564e98ad5c04b3c06259fe9ab3f4d05692bbdea667c4e7b9b3c8805216a180e70f70dc6a7

                                  • memory/664-29-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-37-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-34-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-30-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-44-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-46-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-24-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-23-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-36-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/664-22-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/928-64-0x0000000000A30000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    16KB

                                  • memory/928-54-0x0000000000A30000-0x0000000000A34000-memory.dmp

                                    Filesize

                                    16KB

                                  • memory/928-53-0x0000000000B20000-0x0000000000C20000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/932-113-0x0000000000A00000-0x0000000000B00000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/1064-136-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/1276-50-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/1276-57-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/1276-55-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/1276-58-0x0000000000410000-0x00000000004D5000-memory.dmp

                                    Filesize

                                    788KB

                                  • memory/1992-156-0x0000000000B0E000-0x0000000000B1E000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3420-134-0x0000000000B1E000-0x0000000000B2E000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/3460-20-0x0000000002000000-0x00000000020A2000-memory.dmp

                                    Filesize

                                    648KB

                                  • memory/3752-1-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3752-3-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3752-17-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3752-6-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3752-5-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3860-91-0x0000000000970000-0x0000000000A70000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/4460-2-0x0000000000660000-0x00000000006F8000-memory.dmp

                                    Filesize

                                    608KB

                                  • memory/4460-4-0x00000000023A0000-0x00000000024BB000-memory.dmp

                                    Filesize

                                    1.1MB

                                  • memory/5088-70-0x00000000009F0000-0x0000000000AF0000-memory.dmp

                                    Filesize

                                    1024KB