Analysis

  • max time kernel
    297s
  • max time network
    297s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:50

General

  • Target

    4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe

  • Size

    758KB

  • MD5

    6f83cf92ac13d4f982229e5907dd66d8

  • SHA1

    2d97ea6768afa98cd1d8ba26435f69750b024729

  • SHA256

    4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b

  • SHA512

    9c9e8cc5b718877934429917cf3a200900498462eda756a6567509b7e49635512b867228244a0a863f54130bf8218f67dc037fcaf6adcb1e28002d76368e6e32

  • SSDEEP

    12288:sznNsQjKtYGHis7osbTktOGtFCgd8exs+B7Z0Gh4DD/Pj8HuUAjxgLVLxpjhBxPZ:AsQjKtY4xss2OgFCwtZZv4DD3j8HbAjU

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe
    "C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe
      "C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4380
      • C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe
        "C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:392
        • C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe
          "C:\Users\Admin\AppData\Local\Temp\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2208
          • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe
            "C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3608
          • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe
            "C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4956
            • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe
              "C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4812
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\481c7f21-ac5d-4aee-9a51-ecfd664acf58" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3348
  • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe
    "C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe"
    1⤵
    • Executes dropped EXE
    PID:4496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1912
      2⤵
      • Program crash
      PID:4540
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:324
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1740
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:96
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1020
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:3628
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:4148
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    PID:3668
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      PID:1748

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          b7470a9aa569b259d4c2bb3b80ae3aa3

          SHA1

          093290296b7f1e402ef96e4b33a88f064aa401eb

          SHA256

          ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

          SHA512

          4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          8425c2cef7881bb733698b1fa063a9b1

          SHA1

          2d326cdd80461c89b63107aafeb2d12c2b7c5ed4

          SHA256

          6052c2033ea485747a9d906774377480aa2d85fe53b578bdc23f37972615589c

          SHA512

          1168d0cfb1d10632c32acf8f71a847cb7749fa3f1395bde3a55ea95b9953cf8223b2bbb71f12f33242e1436bc6cfbb3c5b73f8de91738a38a409aa50b9652e27

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          f9820f1050240d3021014efb42219838

          SHA1

          c5defb15a3cdf647632cc8625bd0272fce8cfff8

          SHA256

          1035557e733a31dedccc5d68cb68367f11325673022271d8c182f1478965534d

          SHA512

          8f719f2e8cc6a507bf7d584511c92bb77e6df2168b4fa873cd06956d091271cdb69970eb4bc906bf0d4e49e7ebf24dd84b22369bc4f6037cdb7c372921e0c43c

        • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe

          Filesize

          265KB

          MD5

          d08e8f7e9b683a277f35f956460a7f0f

          SHA1

          39f6f14c5e004efe65e42a6c85f6f5810ef6c0e3

          SHA256

          6abf8996220322e769a32b379e1a7d01023d56fd5a28a70c12d37bc74e8e0268

          SHA512

          a3522d216fd6efa3f2dde539d9f8df5e7c01c6ab5411a874d245e49cc646d4a11a90949b76549e6ba4c1c744e4ead1aa60a0e5901981c7ce016058a01c430200

        • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe

          Filesize

          295KB

          MD5

          b223eb351c231205579ab6b61e6b94fd

          SHA1

          5e83d6467348d00882707ed3baf54dd2673dad1c

          SHA256

          85dbb98e4407e2bf45898c3b7c2fb1fcf7a956a3a215743f30e1b34cf0fef3bc

          SHA512

          16ebfc482eb58e2b4090238c5224d554dfcb3bb7658e2216ba0c407e3643dd4f38285e963a91db7c005bf965863cd93c8360b256b833cfdad2176feb532d4ccb

        • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build2.exe

          Filesize

          275KB

          MD5

          aadbd6db48fbae01b6e75743bc391a5c

          SHA1

          7581ab5c52ffb9a5c08806cb1b008502056834a7

          SHA256

          63aef04f516b8815d7b5cc18d6b41554f0f5aee68c7ee1822fe3951b1b7187a1

          SHA512

          e1a20e288810a31973b9d050b884fa0ac7362443b723625ddc7fea97a51b53124758d06ab883eeba40e2594f3ab242b48ba83554c06b81e513cf429486d2bda8

        • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe

          Filesize

          29KB

          MD5

          cf4572d028de79f7c1065ecfddf3bbc8

          SHA1

          80c81785fc3b1a8cd65557a24be1f28e31e01709

          SHA256

          c9dde988a40e970985fa1fb9b7290dbf660183671beeb2283589d25a2e103f1e

          SHA512

          bb5f17d4b89432e882e15aca5bf53595597f2aab0ccc3e3de6e0e44f6ea2ac2b869c447b01b6058a5e0573b65b240515d5e1c4e57dd180e4a8033eaa0a32260f

        • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe

          Filesize

          5KB

          MD5

          9b68e88a96e9bd56293f4c8b39314178

          SHA1

          a510f7c3d8783d7b8c1335d648cabe70db306840

          SHA256

          73e41876c3fdb962cd993c53d72b055fd7554669bfa8a9ed0de2621cf92f6052

          SHA512

          181322e7bb160f4a6945b5cbc820e39f1ae29e84b9b60bd64e942d9f281f4599e709716bf80ec54b6c39f7f4e3d6d28ec321970ba28617af8027189951eab513

        • C:\Users\Admin\AppData\Local\43dc69ed-a7e7-4b72-b970-0ac4f7cd5e20\build3.exe

          Filesize

          109KB

          MD5

          dce34ccd95d49bdcf51fb7197b2b31df

          SHA1

          5cded5b4c8d8841a7841bd18b326057cebe9c49a

          SHA256

          ccb892eb37e550e3f37adb6a5c0b92b1eede723849119fbf1cf8a32acee6085b

          SHA512

          ce98019f279ac2eebb23e79d80e6ec0f298d609872b1ecfef27c1b22bee664bcc72e7770a681afaeaf0984d38474e7ad9b200a87448f298e5b200cc3b67fc1db

        • C:\Users\Admin\AppData\Local\481c7f21-ac5d-4aee-9a51-ecfd664acf58\4b9684e393bcb5fb779b00fd025100bca7582a89858ce9344926ff7e3206b90b.exe

          Filesize

          116KB

          MD5

          68c6dc4bb98af508ea927973c5ae1f18

          SHA1

          ca81b47161aa74bc8cc635aedf7a7d2b7cd030ed

          SHA256

          ffdb53d1a7b69bd2446cc68e43d2ef550087233baaf7e6fcbd38bf636ea2c97c

          SHA512

          fd780c41c06ca479bf534f72b796ce52f5e79231e28476cae66411da9822d6315b43393f99eac283c744f69f1136ccc2e5eea20ae9999d91fcb0743b93393c0e

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          225KB

          MD5

          06e2d3d1ff70826a19b9126473cd3b2d

          SHA1

          9a673b489ffb097ad3f9807e5975427857302e67

          SHA256

          7d11d5a5e60feba709e691f4399b833fafb20dffd6ca21ea6bc9790f25341906

          SHA512

          0d6b85dc7b895c499e697636bf020e301fe3adedbbed0371fe875887042902871c9fc9a49c3f6a0f1ae1319cbe35a19d3b5f47369821f2f69bb0eeae33748505

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          101KB

          MD5

          413be23c0c3b8d82d5c6ba901be6025a

          SHA1

          1dcbb509a094e832eb1851f4167dffdce8a8206f

          SHA256

          d7d0b766719ab9f192026d7bc2113a4e27648b07e8e274445b225545b57009c1

          SHA512

          c709e092b4ef5c9ec347a3386bb0db03efed1226805c5a5e8d22587a9ce1217998246ae72c8d4f598da285685919db626e882e4dedbbb269a1921e462cf48a8b

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          47KB

          MD5

          c9dd4ca6c5c1546b84baddd9cdae5e2e

          SHA1

          b99b7ef16c624198ed897e49dc8a32b9712f95fa

          SHA256

          8d5f08c10710f2e7911ef2f6d841810d8bfb498f0ec94935d2434113a983bdb4

          SHA512

          2734158f2fbb213f4abfe0c777cc5a6036baa71683f55e8d8f142d0b29b1e7fb895be2d8166a753e1069ebbdc4573183ed6d9653b28396d5705b588e4afcb7e2

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          29KB

          MD5

          d920066e6c8cbb4281cf45b0e1ac4134

          SHA1

          3bcf903dfac0f5ef6b5cd5e4c6a7e43e8cd1f4e4

          SHA256

          f35c83a16eea9da526472d30e4075443134876b979bd3ab22aae89158e999fb3

          SHA512

          68e6dd347de535b1d8e82fe784ca31ea71e3f35b8348caa4f1cb2a472543d8b70b1527de315a212a6d5bd00cc24a4dcbe157f11321b31223cbfbcb37f2b37b95

        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

          Filesize

          299KB

          MD5

          41b883a061c95e9b9cb17d4ca50de770

          SHA1

          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

          SHA256

          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

          SHA512

          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

        • memory/96-124-0x0000000000AAE000-0x0000000000ABE000-memory.dmp

          Filesize

          64KB

        • memory/392-20-0x0000000000530000-0x00000000005C7000-memory.dmp

          Filesize

          604KB

        • memory/1020-127-0x0000000000410000-0x00000000004D5000-memory.dmp

          Filesize

          788KB

        • memory/2208-63-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-29-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-23-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-22-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-30-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-34-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-24-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-37-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-36-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/2208-54-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/3608-50-0x00000000005C0000-0x000000000060B000-memory.dmp

          Filesize

          300KB

        • memory/3608-49-0x0000000000620000-0x0000000000720000-memory.dmp

          Filesize

          1024KB

        • memory/3628-151-0x0000000000940000-0x0000000000A40000-memory.dmp

          Filesize

          1024KB

        • memory/3668-178-0x0000000000B10000-0x0000000000C10000-memory.dmp

          Filesize

          1024KB

        • memory/3964-4-0x0000000002280000-0x000000000239B000-memory.dmp

          Filesize

          1.1MB

        • memory/3964-66-0x0000000002280000-0x000000000239B000-memory.dmp

          Filesize

          1.1MB

        • memory/3964-3-0x00000000021D0000-0x0000000002270000-memory.dmp

          Filesize

          640KB

        • memory/4308-102-0x000000000092A000-0x000000000093A000-memory.dmp

          Filesize

          64KB

        • memory/4380-17-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/4380-5-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/4380-2-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/4380-1-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/4380-6-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

        • memory/4496-52-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4496-67-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4496-46-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4496-51-0x0000000000400000-0x000000000065E000-memory.dmp

          Filesize

          2.4MB

        • memory/4812-71-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4812-76-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4812-79-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4956-77-0x0000000000810000-0x0000000000814000-memory.dmp

          Filesize

          16KB

        • memory/4956-74-0x0000000000879000-0x000000000088A000-memory.dmp

          Filesize

          68KB