Analysis

  • max time kernel
    14s
  • max time network
    293s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:57

General

  • Target

    bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe

  • Size

    817KB

  • MD5

    14a5973627a876bdbafb029a26084f64

  • SHA1

    5514e9a9d8806406ff9921c9be25bd1e314b0b9b

  • SHA256

    bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5

  • SHA512

    e6cefb5181f6bfef6c17afc961e5d8186115ce01e06160a4c08b88933f314f9e64010c04936e2511af543e49218fc4186bc59239e5d4254b10b3d517ca644808

  • SSDEEP

    12288:zesZm5MEXDLUudx8Qp5+C6+gNfGtQaUkyUExxald2R6I6RR1nPK6AuVW:E5MOeQp5NgNfTkyUExxalYQNjZP0uVW

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 9 IoCs
  • Detected Djvu ransomware 18 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
    "C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
      "C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\50a55700-73a8-4958-b97e-431298acd57a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4084
      • C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
        "C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
          "C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
            PID:1900
            • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe
              "C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe"
              5⤵
                PID:1428
              • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe
                "C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe"
                5⤵
                  PID:5052
                  • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe
                    "C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe"
                    6⤵
                      PID:384
          • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe
            "C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe"
            1⤵
              PID:64
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 1912
                2⤵
                • Program crash
                PID:1960
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              1⤵
              • Creates scheduled task(s)
              PID:1984
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              1⤵
                PID:1592
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  2⤵
                    PID:4436
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  1⤵
                  • Creates scheduled task(s)
                  PID:3628
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                    PID:4172
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      2⤵
                        PID:4084
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      1⤵
                        PID:3472
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          2⤵
                            PID:4780
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          1⤵
                            PID:4292
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              2⤵
                                PID:3836
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              1⤵
                                PID:3028

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                      Filesize

                                      1KB

                                      MD5

                                      b7470a9aa569b259d4c2bb3b80ae3aa3

                                      SHA1

                                      093290296b7f1e402ef96e4b33a88f064aa401eb

                                      SHA256

                                      ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

                                      SHA512

                                      4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                      Filesize

                                      724B

                                      MD5

                                      8202a1cd02e7d69597995cabbe881a12

                                      SHA1

                                      8858d9d934b7aa9330ee73de6c476acf19929ff6

                                      SHA256

                                      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                      SHA512

                                      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                      Filesize

                                      410B

                                      MD5

                                      b53c8c6885abed41527cb077397f49c8

                                      SHA1

                                      6632c25865d784c107038f7963d720c92640a767

                                      SHA256

                                      1883c062dbf55ca4b52b71622efb8127acd9d56a2b5db1c7888ed5737f2345f8

                                      SHA512

                                      035232100350f76b2f9241037248ab6696e45fbbbb18856ca04b8282129ec492ab345b419247d9e65c0d96528b0d92ba91d60f658fcc8921c44cf1b8c4473c2f

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                      Filesize

                                      392B

                                      MD5

                                      bfe924ae20700a8dba37bdd0677ea45c

                                      SHA1

                                      0fa2d210bdb511100054c5315c12c2f43cf334f1

                                      SHA256

                                      074688d41f4e9fb7f2c480f6fc2b9cea49a739c9870b0494902983bbc653f358

                                      SHA512

                                      a6b02c4ca493e068c3c2874fce05effc0d648503c08648cf742d22649d9a623259bb119affa757395ed10257fcca19ba3ffa3a5b94dd8d809c33562bceaf730d

                                    • C:\Users\Admin\AppData\Local\50a55700-73a8-4958-b97e-431298acd57a\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe

                                      Filesize

                                      88KB

                                      MD5

                                      94f84927d4e355c5b599a2a972635903

                                      SHA1

                                      4943750c862ed4d6dd2ab799ec4662684b6adea4

                                      SHA256

                                      7ceb08abf45d7784d9bd9915d212381af9b0ead357c4f96382b63335497f1dfc

                                      SHA512

                                      e91709be7222cb053609189407c0e328b3056630d08ad9cd08f3e8dc87dcbb649506bc32f0315a0895a4d686164ab832eb199614ec620672fd5ad54adc735cbb

                                    • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe

                                      Filesize

                                      46KB

                                      MD5

                                      566f8ba884fedc599037867b5fed567e

                                      SHA1

                                      59927264e8d4316a6133727381aa8de1afe618ce

                                      SHA256

                                      482fd2f6a2f0d7126e1cbd51c139891f3b9fd1bad52a10e6cc7e58327b3de4d6

                                      SHA512

                                      beca9510603ea1804d9211d79e3d7139f50b7db4927bd13b6debfb4b78345b383c0efe38ab49dcd31484fd8f9c4427d24d987d8d7685e92f2247b67e80a2df43

                                    • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe

                                      Filesize

                                      33KB

                                      MD5

                                      c0161fb5fa5b00daf54656649c61a548

                                      SHA1

                                      c368e2e929423fcb406bded2ba2a01aaa0485b30

                                      SHA256

                                      dc8118a7ae2a604d138651c4abb65c908bfd8878ad554bf57aa14d3539547674

                                      SHA512

                                      1cc3235012514a6f6a5646e0a9d07b1bcb2dc123ec7b6a2e8e406799c14380bb3126b5f3589c78ad2b2ef1e6d5774c721b5d4b491764577587efaf8491bbacf5

                                    • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe

                                      Filesize

                                      46KB

                                      MD5

                                      dd347e4a9eed3f1a684c19b9b0dfe98d

                                      SHA1

                                      eb1385312bf570229e612e0d905b51743ba7442e

                                      SHA256

                                      62b9e22ca2ca9c4ee7e9dcdea5bd25209ff189c16a3673e6e0d11a431b820028

                                      SHA512

                                      a99b59f754bda2ea3bfcc639210aa73f169325be03524305ede04f3c1fa8a140e9405546e86d633992f50df5c2f9a8bce6ed589ed7c415e99652c5f25df29ddc

                                    • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe

                                      Filesize

                                      49KB

                                      MD5

                                      7655a8ab6ad65f8b0c06e7d6ef573694

                                      SHA1

                                      9c8b88729fe4cda48a7801839f6dc008ead4e50e

                                      SHA256

                                      1a5f238fbb82d782f9022af75c69d02d0a6b02a20e96c45b417d19380b56fcb9

                                      SHA512

                                      fc12524fb4ea6e241e6b902f9f8387336a8c8c27f8fff10493fe0bc1ecbb86ecc21b646319fc423e9a4a578b167b2a5d9cf7b21c1c821a3d7b2e16789c536809

                                    • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe

                                      Filesize

                                      49KB

                                      MD5

                                      b9ff3f154c8d97ad58641b02d7e1c750

                                      SHA1

                                      6f5a0ae803618bc9dc5b052db093b5376a166435

                                      SHA256

                                      28c1869ee2522018be4e6f32f81deb8312b25196724bc8548ccbaefaf139ef9a

                                      SHA512

                                      4397ef4e178423ab55409f7aa668c9d63d5e10432457aa4ace1dc90a09313be3bbac55b6c888667a1242dd918b0fb53b2ccc3edbf6b873cc945ffd254ee9747b

                                    • C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe

                                      Filesize

                                      29KB

                                      MD5

                                      13bef8579f96b08d065dc71343b9332c

                                      SHA1

                                      8cc44aee8fe03a996fb4ec171be00a70775912d0

                                      SHA256

                                      33087e53fd814c39a30e5b9d55e158a75191f45bf7883c0e25bbd5cc9f6c9af3

                                      SHA512

                                      988d63570f84242966a2c7f0fb7bc71d43201fe4f5308fc8ed2e5be2363a5b6dfe233447b4ce537f640aabc3293224e462461dc6f69b859c0ce1455c2aaf0fdb

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      49KB

                                      MD5

                                      ffa1fceb3d7fafa3757d48a64fa93f5f

                                      SHA1

                                      3d85f27c84ba62fc3c6195bb7762a177daa0e6e3

                                      SHA256

                                      53b469ba0d446e1ccb9aa596b5a98935cd22d0c37b5d8e9ea39c1bbe948fe2ae

                                      SHA512

                                      c447d7db3d70f3acb7a99d57d355466f29d55b23412737fdbd1020b5ba9512fd4c7f3b8d3a783ec1c38cc4e5153a47e46728355fde81e3a2360a3a3d03dcc9ba

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      12KB

                                      MD5

                                      e240a6468baf4a67a503853cbed40581

                                      SHA1

                                      80a64abc42c63b3c9657eb37a4202759423ec2b7

                                      SHA256

                                      a4c0bf4b878ee9797b65b0eba70d9c901a23929565dd8cda0c3b5d658f19a891

                                      SHA512

                                      f1a0a711babcd43c724dc684a10e50f9d3c6358e9b05341fab11487daa6828cac46eb40a781c199ee660254734f8ab24ba3f737368d3cb450aa69ade836a174f

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      57KB

                                      MD5

                                      74ae9689cb04bde426e036319feeb49b

                                      SHA1

                                      b932fd3571f6113cacf1e5eb2b3453a05887963c

                                      SHA256

                                      b59f5c8dc70d0092f4257c3e13745f67e6324edeee709eff32336d3c93bca180

                                      SHA512

                                      642d69ab7ef11418b9d97cfa8882ba38ba5c08fcec428a8a758b9de8ee1d576b4d1fe1a2ca93dc4f1f5e6a8eba8c21f7309975c0c43033350d51e5efe7fcafca

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      98KB

                                      MD5

                                      95b079f9b83988b2253843dede4b3b19

                                      SHA1

                                      13104dd654365715d64cf2ca083c5fa4c6458f3e

                                      SHA256

                                      df0e29c690158bf6943ef9fac22b10be7a3b590eaee291ea4fcc67d59c8501ca

                                      SHA512

                                      587ba3171d80122efc86b418582e922a61131ee55d015feb58661e560f9bb24fa7ef6eba5053f88aaddaeb21c05e15e420774db430b9850fa55b743acdb7afb0

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      37KB

                                      MD5

                                      e36cf7b8863ed683e3bb596d28d9582a

                                      SHA1

                                      769283b659f5581b8d8cd5c1ddcf80bdfdede5fb

                                      SHA256

                                      36d0ed0156e857587423d0b364dd7aa6ffc33db524466c02a3dc30242aad4c0d

                                      SHA512

                                      6e759fc12a3c75c33aaee2eccb6bf58cd5e7084e208b1eb5d5000c41df43dc6581e4e2638073cd41604c69a445de9aaa3f66b4e6dd8856ed05b673b09e339373

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      64KB

                                      MD5

                                      8b6a819c6926597dfa7529b692d7a6cc

                                      SHA1

                                      50c535e9cca464afd3a589d2231d87ce417d4312

                                      SHA256

                                      b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c

                                      SHA512

                                      dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      26KB

                                      MD5

                                      3bb3d56a18eec9b79c287cf1e1b41f1c

                                      SHA1

                                      d37dcf4f1349e3f8ab13b1d859b0533066fbffe9

                                      SHA256

                                      574b4e621aea47f875c1edb98fbfc71d4d302bb568137fbb12a304df0b782c9f

                                      SHA512

                                      a07dede517a571da1f1925cd9ae63fa38b5e5c0dd20458b47198ecf3d1bd862c74a5eef17e3a5192819a796faf7a8b84b59a60837ccbc51dd748b453d8fe2d8c

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      16KB

                                      MD5

                                      5169d2a060a54d0bbbd3027fc19a4417

                                      SHA1

                                      2342990e51952aabf570794ababcf643507e4f4d

                                      SHA256

                                      7167395afd26254c61eb9fe58564f01409b402108ffb17564508064e09cc29ff

                                      SHA512

                                      c70d02ce8b59807e1da70d95deec3af679ed05f4a7171771bb1fb767a1812ebcbdf2afd2ce72c7f685f33248ea7f1b55f5cbcccdd4743685df2a97edf88f6489

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      45KB

                                      MD5

                                      5c2b090f6e218209c9c7f4fa935265d5

                                      SHA1

                                      4a8d96c4f25b9912306d3ef178f9b62ca6018286

                                      SHA256

                                      3264a8f122706de1bfb1001716d7fc3388f1f083832d25aa5c8fc6ca83d3eada

                                      SHA512

                                      1dbd88ce19403aeb8dc0973e2bf08627d49e7dec715cea196135366e1c3979add3c9545b975149cf25d99b89606d81f5d26e0f23368202ac431eb7fc35e86e82

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                      Filesize

                                      92KB

                                      MD5

                                      4b3fc3105731c7ff3a7e3966416912a2

                                      SHA1

                                      0e792bf25e8795158074fa6bd2ee87ad16675124

                                      SHA256

                                      c0f698bcc4324958848de5d8e1b1bdaed5e01632d8c827a5a95356eb04a2c443

                                      SHA512

                                      6ed5ee0139d9d9a676232a6c5d6e9a8528f880025a11fccf8a1a32a999ae5fac41f993c384fabec788e4e47da714d67f1def0348da6b0f4392e7fc7ff1098c28

                                    • memory/64-66-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/64-51-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/64-52-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/64-48-0x0000000000400000-0x000000000065E000-memory.dmp

                                      Filesize

                                      2.4MB

                                    • memory/216-3-0x0000000002680000-0x000000000279B000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/216-1-0x0000000002510000-0x00000000025AF000-memory.dmp

                                      Filesize

                                      636KB

                                    • memory/384-78-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/384-73-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/384-81-0x0000000000410000-0x00000000004D5000-memory.dmp

                                      Filesize

                                      788KB

                                    • memory/384-80-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/520-5-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/520-6-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/520-4-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/520-2-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/520-17-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1428-46-0x0000000000690000-0x0000000000790000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1428-47-0x00000000005F0000-0x000000000063B000-memory.dmp

                                      Filesize

                                      300KB

                                    • memory/1592-99-0x0000000000B20000-0x0000000000C20000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1900-30-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-63-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-53-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-21-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-34-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-36-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-24-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-29-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-23-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1900-37-0x0000000000400000-0x0000000000537000-memory.dmp

                                      Filesize

                                      1.2MB

                                    • memory/1924-22-0x0000000002420000-0x00000000024BC000-memory.dmp

                                      Filesize

                                      624KB

                                    • memory/1924-67-0x0000000002420000-0x00000000024BC000-memory.dmp

                                      Filesize

                                      624KB

                                    • memory/3472-150-0x0000000000930000-0x0000000000A30000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/4172-124-0x0000000000B70000-0x0000000000C70000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/4292-177-0x0000000000980000-0x0000000000A80000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/5052-77-0x00000000008E0000-0x00000000008E4000-memory.dmp

                                      Filesize

                                      16KB

                                    • memory/5052-89-0x00000000008E0000-0x00000000008E4000-memory.dmp

                                      Filesize

                                      16KB

                                    • memory/5052-76-0x0000000000B80000-0x0000000000C80000-memory.dmp

                                      Filesize

                                      1024KB