Analysis

  • max time kernel
    13s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:55

General

  • Target

    8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe

  • Size

    826KB

  • MD5

    565c475cae0e0db1c7f91152d5b5e8f2

  • SHA1

    11af57d84807b03b63ff723c67e2f6cc7d7a1bb8

  • SHA256

    8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9

  • SHA512

    aebefd3c27131765a0763cc58032fabf98521e63507b2b275754eeb10565b5a3f4a598bda0dcf2e1df269493cfb456607b45142a0bb904ecf4d48c60907101c4

  • SSDEEP

    12288:qBOa47KdFltkD9ZnRzNr/tv7KqNjkyTy5O0R/nSj8vzCu6ww:X0vkDjRzNrVvOqNjkyTy59PSjWcN

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 6 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe
    "C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:32
    • C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe
      "C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe
        "C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe
          "C:\Users\Admin\AppData\Local\Temp\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
            PID:4376
            • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe
              "C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe"
              5⤵
                PID:3096
              • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build3.exe
                "C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build3.exe"
                5⤵
                  PID:1428
                  • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build3.exe
                    "C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build3.exe"
                    6⤵
                      PID:516
              • C:\Windows\SysWOW64\icacls.exe
                icacls "C:\Users\Admin\AppData\Local\e83253ac-c548-4ae9-ba5d-daf40a11c3e7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                3⤵
                • Modifies file permissions
                PID:3220
          • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe
            "C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe"
            1⤵
              PID:768
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 2124
                2⤵
                • Program crash
                PID:4904
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              1⤵
              • Creates scheduled task(s)
              PID:3284
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              1⤵
                PID:2316
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  2⤵
                    PID:3352
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  1⤵
                  • Creates scheduled task(s)
                  PID:4624
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                    PID:4672
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      2⤵
                        PID:532
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      1⤵
                        PID:528
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          2⤵
                            PID:1624
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          1⤵
                            PID:1396
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              2⤵
                                PID:1288
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              1⤵
                                PID:4352

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                      Filesize

                                      1KB

                                      MD5

                                      b7470a9aa569b259d4c2bb3b80ae3aa3

                                      SHA1

                                      093290296b7f1e402ef96e4b33a88f064aa401eb

                                      SHA256

                                      ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

                                      SHA512

                                      4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                      Filesize

                                      724B

                                      MD5

                                      8202a1cd02e7d69597995cabbe881a12

                                      SHA1

                                      8858d9d934b7aa9330ee73de6c476acf19929ff6

                                      SHA256

                                      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                      SHA512

                                      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                      Filesize

                                      410B

                                      MD5

                                      a5880bb558f251bf49601bdbc890a20a

                                      SHA1

                                      f43fd9888c04ce6ea577d11091ec0a677a9be5c3

                                      SHA256

                                      1ac8406c325ff9be59cda63c503f97f6d3c8755fbc0e4e15513005b53e16727c

                                      SHA512

                                      e619f75a15b0452f3d341e3da5a4c932983e4d2cf11d47c06e722fc942627fad203c157c439fdede7f212021a2700628386873018b194a394ca154139faa8b8f

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                      Filesize

                                      392B

                                      MD5

                                      ef951804d83d42e94093d6f68c07f9d2

                                      SHA1

                                      864e4060cb37218705d153ff2c8d553fe9b318c2

                                      SHA256

                                      d6ad7cd11a8ed0a8aaaf5517cf22e56ec54a0a191c1bf51d0ef3cacdb8be6640

                                      SHA512

                                      52baa65e1282b5a639bef6d0b1f807dda888df48832a8ee85d05fbc1623e5aaa3fb25b6185f8f0207ed67cf87465d8bdcc76f24c892c6867764afd2d51bfd651

                                    • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe

                                      Filesize

                                      72KB

                                      MD5

                                      227bfb0951a0d2f67a8a6e5aee226287

                                      SHA1

                                      cf91ffd1b9c0d31376b4f4b418f7749af3b1ae83

                                      SHA256

                                      c94b13569cd5a65aca14485be5c22d6d7d50ecb00168225c85427be51ceb0b41

                                      SHA512

                                      2105a7c8a4092ab0c2475e909abc541b68835557a310f28c45c6614c9ed0b8438f482abdfda2558e240002b0520e33e519e9189fbb9b2c25727db2bfc2cbd288

                                    • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe

                                      Filesize

                                      92KB

                                      MD5

                                      d7013d4a16dcb0ae1c0ac2c19efe97ea

                                      SHA1

                                      8d5d3fe7ac2185590945ddc1a9d2f57c2adc1798

                                      SHA256

                                      5f14916a8a0774595b499bad71b3b7b99b975988c385d1f6ed1da193fbd55e8b

                                      SHA512

                                      3f57ec1b2846268a23168274961688895e2237fb0a3436f05b8f646c8ac06346930768832cfd8e0299da00a3901b7d0cc3ae42b363c11451a99dc96cc39e936b

                                    • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build2.exe

                                      Filesize

                                      11KB

                                      MD5

                                      dc94417658b1f709196f99a4aefc5d07

                                      SHA1

                                      eee92c99e882bd027724d07397fbf2be12fad50c

                                      SHA256

                                      af3af3b808598bd7c394873d6fd849c86b7b065e46389711924381da30791311

                                      SHA512

                                      bf3fc3cf9cf271d928a9d7c81f04204fee8b91a76b02a8b99f59fcdd57e26b1fe656dd443cc002d1b841ca155de7bb41053514d9460ea72dc9b75cd150664b16

                                    • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build3.exe

                                      Filesize

                                      138KB

                                      MD5

                                      2185ec6ff89c19bedd26198d18c6fdfd

                                      SHA1

                                      ec9258ae360862f5aeb4f9002162fdf0d32750bb

                                      SHA256

                                      ec7529430a9fa15bb599f5d8c28f61f3bf124a40bb8bfb5565828f5c8cb145ce

                                      SHA512

                                      011520c59b9cd6b27197fe00dc14ead319a02b6d2fb89693624ce322b78d3c2ae3371d946d9f66461994afb4248f6f563ec190a1558fe82493eaa75376857232

                                    • C:\Users\Admin\AppData\Local\114a5cb3-dbbe-4e93-9e9c-b58f5e3d0f73\build3.exe

                                      Filesize

                                      64KB

                                      MD5

                                      8b6a819c6926597dfa7529b692d7a6cc

                                      SHA1

                                      50c535e9cca464afd3a589d2231d87ce417d4312

                                      SHA256

                                      b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c

                                      SHA512

                                      dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9

                                    • C:\Users\Admin\AppData\Local\e83253ac-c548-4ae9-ba5d-daf40a11c3e7\8eaab3be19d780dc79e63aea6a88880880c8a9fcc6b8a729e8db0b8e1aaedef9.exe

                                      Filesize

                                      107KB

                                      MD5

                                      a3790a729a8151b6ef93264c3453a43b

                                      SHA1

                                      49a5fd7ec7d173e951482399854b4d88e9b4ec97

                                      SHA256

                                      9bb8f59333ce6ff89161dd00816ed4bad8522954e57fa2b86ceee8e585a018a0

                                      SHA512

                                      784123dc09c0fbf28d16e9b26bfa3e334474a816c3e93fc3d6dd2c9be607ea48baf7658f24e3518190879f548834aa2e0faeb1e47581ae1ca5ec0700f2d66c01

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      28KB

                                      MD5

                                      3d5a035c7e9ff3d5e8e60982fa667810

                                      SHA1

                                      f87a8286c0046ef256d676ff26ea26162d0194bd

                                      SHA256

                                      f54febd75150d67815ca248c80ad9833e1f3f3e699b49694d1010d018fe5c6cb

                                      SHA512

                                      f43287e118cb0d20c63ba1d4e2eda5cbd9ce221a8f32131c6444088a054a5812d0d7ade930955be8637c6923d83bc24a8890e91f0ff9597716b5758cb974112b

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      1KB

                                      MD5

                                      d35c806c95b926208b06f305860de044

                                      SHA1

                                      fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b

                                      SHA256

                                      722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061

                                      SHA512

                                      cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      11KB

                                      MD5

                                      7ac590b0f60109c6885297639b399aff

                                      SHA1

                                      5e3d225b12fe3786f6fcd5b8933361fbaab00448

                                      SHA256

                                      d29b62f633ee16d0014125eaab6bf7a7b51f2a2e48434f3daf8930d19581909a

                                      SHA512

                                      35883d148b45a09c8c7e45136b2b4cff44c8f3bec8bdf86659757fdd2e83425c8b80454cbc43fe33507d647abb6328400cfc8750b3525439ad15bea0d18c059c

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      9KB

                                      MD5

                                      9f2a96367a52c87cfc6a9126f452cc2d

                                      SHA1

                                      6df22db4fb95700b0f121bf2e6d345ff9075079d

                                      SHA256

                                      d19625b085e39f32ee3a9740cc622b0328aa321d83cae210599351d1402a3f47

                                      SHA512

                                      d72cd533c12a1d435e43d8f2a7a31b1595feaa8069bb39a99e4467751090e57f8f6fe0b262a5a78ea5bf3ff55e35bf3dc1ab653468fef7527bbacf5a505e967d

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      43KB

                                      MD5

                                      6d6bf27d4f8bcf7afce1ade269983408

                                      SHA1

                                      3de8af0ea8e84758c0f618d02240b35e867a90ad

                                      SHA256

                                      45d6dab0457ca8013f56a442a594618e0e8cf5c45b8e58debcc9fc12d47caae8

                                      SHA512

                                      919f5aa13479cda4df9964cbbf296942368140993877ca1dec1485484ca9708ab2830552a3c468c8fc5ae1160bc9e8180481211d3453d4d817a5a898eb4bafd2

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      15KB

                                      MD5

                                      855a6c01739b0c34131081b6237d9d8b

                                      SHA1

                                      edd4ffb04c289a036cdebb5cb8c839092d7a6e4c

                                      SHA256

                                      4bd0bcdcab226b0c7498656543d9017925553735170dc8ce88e628782063806e

                                      SHA512

                                      4c01ca3b17fdfdad6a245c9d3ff978bba0c96e0c87b64109e33e559e4de9ae321a8864a6a5cd28795a40aabc2b620de2a636a03b5af8a1bb7ef45bf2337fa320

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      44KB

                                      MD5

                                      03a92b8a9d36fbf94fe977bbc3893658

                                      SHA1

                                      9d6ec4eee3f47ccc7ae0d1b22238eeb6802c69db

                                      SHA256

                                      647c32d6db0656b885170580bfd380bd8bc12dd8cc98014d2a3f00d9af38f01e

                                      SHA512

                                      d39d719dfafeecf9cb728b9edd31655c8c5f42e6f28c8857a44e82cc447d9e81f6535ce1a87a29cf5e30a21ed57d14ea76fb123dfd2932fd2c7999d327f55de4

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      299KB

                                      MD5

                                      41b883a061c95e9b9cb17d4ca50de770

                                      SHA1

                                      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                                      SHA256

                                      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                                      SHA512

                                      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      208KB

                                      MD5

                                      cd96202c79ed00694ab8e766210e2273

                                      SHA1

                                      a4b3ce543f04d25ea82d32761b5740429abc8f6d

                                      SHA256

                                      53aed3f1047e9c5ab66b3b859540821c274ca25b0947e68dba892f87a806f91e

                                      SHA512

                                      aaa2856ae95d4ab556886c12c3f48607c968c9e9b4364e07d4a52e75dc7d9eb7c16bcde2e2250bcedb6e691da9256f8a7287faab962cac5cd2952c295ea12ba5

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      169KB

                                      MD5

                                      bc9eaccb92834aa657c018db83528f96

                                      SHA1

                                      68dd4fc506f06e5a5def07d963b660f2af5b600d

                                      SHA256

                                      4c753d8ef6d03dd4101bb9fd3b89e569b6d1cbea6a4970080ed12014557c474c

                                      SHA512

                                      5316c86b8f66d56f10aa765a2e33df754d0a87742a4310abd9c93ea9a4e3bc624075f07dcf6fb3aac8b57a4f911f603303bc7df1a251ada06592fa0d104a4e1b

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      47KB

                                      MD5

                                      e6e191ea6c57f0ab22152f3aec61e771

                                      SHA1

                                      d31c67b48d6e4ebe447bd1ae0a00c15a35abbc3d

                                      SHA256

                                      d12b26bdd97c860c729088bab2de6db667c562e023eb2cfb5db536146accff2e

                                      SHA512

                                      0f493586bbdfd65369a1c918fa2e42e03030415091b64f0df80662ff1f63a1bd9a5b2ce0f5855d3957bd2f95d56888cc597234d91c370c8e34eb091f05eb1baf

                                    • memory/32-1-0x0000000002720000-0x00000000027B3000-memory.dmp

                                      Filesize

                                      588KB

                                    • memory/32-2-0x00000000027C0000-0x00000000028DB000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/516-71-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/516-80-0x0000000000410000-0x0000000000411000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/516-77-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/516-79-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/528-148-0x00000000008F0000-0x00000000009F0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/532-123-0x0000000000410000-0x00000000004D5000-memory.dmp

                                      Filesize

                                      788KB

                                    • memory/652-20-0x00000000023D0000-0x000000000246A000-memory.dmp

                                      Filesize

                                      616KB

                                    • memory/768-51-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/768-66-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/768-68-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/768-47-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/768-53-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/1396-171-0x0000000000A60000-0x0000000000B60000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1428-74-0x0000000000909000-0x000000000091A000-memory.dmp

                                      Filesize

                                      68KB

                                    • memory/1428-76-0x0000000000860000-0x0000000000864000-memory.dmp

                                      Filesize

                                      16KB

                                    • memory/2316-95-0x000000000080A000-0x000000000081A000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/3096-52-0x00000000020D0000-0x000000000211B000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/3096-50-0x0000000000630000-0x0000000000730000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/3096-69-0x00000000020D0000-0x000000000211B000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/4376-29-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-36-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-30-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-34-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-38-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-23-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-60-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-37-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-24-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4376-22-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/4672-120-0x0000000000A1E000-0x0000000000A2E000-memory.dmp

                                      Filesize

                                      64KB

                                    • memory/5096-17-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/5096-3-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/5096-4-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/5096-5-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/5096-6-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB