Analysis

  • max time kernel
    21s
  • max time network
    304s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/01/2024, 04:55

General

  • Target

    ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe

  • Size

    794KB

  • MD5

    b39217e76b21bf17052cd2abd00aef34

  • SHA1

    31cf90601333cc6b46bf0a6b4cdd62cbdabf9067

  • SHA256

    ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2

  • SHA512

    bfc5d6b0ca0f841e8900bae346ab0f8e101f1bd5422c56704de70505e90c8f228d2a8ea5eff982a0fb55f4bd315cf71cffae021137a16f7446ad2bbed98e73d8

  • SSDEEP

    12288:pRaF0bZkvLCji7MzHKLub30T+QlDKxhcQQHipHXBxvy7r:pRaF2Z3ji72HNbEaQxicLHAlEr

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdpo

  • offline_id

    Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
    "C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
      "C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4460
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\81d357ab-cfdc-4212-8f82-4a1b4456f6e4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1296
      • C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
        "C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
          "C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
            PID:3108
            • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe
              "C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe"
              5⤵
                PID:4512
              • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe
                "C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe"
                5⤵
                  PID:3592
                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe
                    "C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe"
                    6⤵
                      PID:3328
                      • C:\Windows\SysWOW64\schtasks.exe
                        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                        7⤵
                        • Creates scheduled task(s)
                        PID:4152
          • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe
            "C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe"
            1⤵
              PID:3260
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1896
                2⤵
                • Program crash
                PID:3448
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              1⤵
                PID:4124
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  2⤵
                    PID:2836
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  1⤵
                  • Creates scheduled task(s)
                  PID:2188
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                    PID:3180
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      2⤵
                        PID:2504
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      1⤵
                        PID:748
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          2⤵
                            PID:3796
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          1⤵
                            PID:4228
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              2⤵
                                PID:4484

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                    Filesize

                                    1KB

                                    MD5

                                    b7470a9aa569b259d4c2bb3b80ae3aa3

                                    SHA1

                                    093290296b7f1e402ef96e4b33a88f064aa401eb

                                    SHA256

                                    ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6

                                    SHA512

                                    4da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                    Filesize

                                    724B

                                    MD5

                                    8202a1cd02e7d69597995cabbe881a12

                                    SHA1

                                    8858d9d934b7aa9330ee73de6c476acf19929ff6

                                    SHA256

                                    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                                    SHA512

                                    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                    Filesize

                                    410B

                                    MD5

                                    8f338ad47439d6349242b9657e571cc5

                                    SHA1

                                    a0689579db1fef7704ba627c8a590a0f1f9d661c

                                    SHA256

                                    8725b41a81db65a6f38c4c9282300e3a541123594710d4940b15a90d8e2e11b1

                                    SHA512

                                    92e0648109d2c810930c678b58a77990082697c9db6acf5d296e7ef779bba748b1e8893f7ca32b494070570cd0670de9a4524981d1b91076c0857b2c08b3f0f2

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                                    Filesize

                                    392B

                                    MD5

                                    d3af9b175cc3f8660bfcdd19c712cdad

                                    SHA1

                                    c9ca56f1a94a13c4d1cc3126163af9e6f2f3a076

                                    SHA256

                                    cb566e8eb2007006130b213b6711338cb43aa1ffa3c8143a0cb9e72f0c938b17

                                    SHA512

                                    af82db0cc51c5eff897441c166313c6cd8871c843d6e99cedde3d79aa87a27c63145ebf43e519324b78f0b1f4ede2c722c8b11b341cfec35c8572f9e7729ae04

                                  • C:\Users\Admin\AppData\Local\81d357ab-cfdc-4212-8f82-4a1b4456f6e4\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe

                                    Filesize

                                    18KB

                                    MD5

                                    2dece59d47456dcebc1b2a838d6a0016

                                    SHA1

                                    fff2c2791c8ea2691eb74707cfc1284df2115a03

                                    SHA256

                                    43bbb2eb226c4630f1e31771c9679b3e44ea9303abcf486d616f49610e7b8454

                                    SHA512

                                    928ea5089f6bdfc6d2574c6e6d15db0aaac3c6075bd958cb2474e307b2bdedae4e1f413a664eb0bf4562780e5efddca30adad53b23b1e38c4586b6403d95ab5b

                                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe

                                    Filesize

                                    51KB

                                    MD5

                                    28b9e1c1b007c047b29aedbbb1ebfff3

                                    SHA1

                                    61da7928d700065a97e9f633dd95ee1d4ffbc82c

                                    SHA256

                                    7d15d1e9286b8c4a1ca5617e175653e683aecefe18caa9825b63ec820a5e467c

                                    SHA512

                                    4ed25a90b6d7d4e8d40c558ad996446151a1557ee3df90c1c4c9373f7f4904e3f37aa3dc8a721e5cdd64cb70d24ea684d27b342d39f8d7a48d39b135c56fa4b0

                                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe

                                    Filesize

                                    23KB

                                    MD5

                                    2e6c8168f3ec29356a8b18525ff08afc

                                    SHA1

                                    f81bee7e73f78eb6c574ce2255863df6f6b7d688

                                    SHA256

                                    9bb525624d28204af1f8813d411c66493fabc5f4bc5c9a0884c0acd9ac4a71de

                                    SHA512

                                    7e51885fe43bb0e3de31651c726ba32fe1a3787438f7ab92baed6e2f392d5c73d5bc2febf04a4147b9ecb3aff10cb69fb8ecdea64557a366cd9917c9cc0a6b46

                                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe

                                    Filesize

                                    16KB

                                    MD5

                                    c021b3be5c367bff4ca8b10cf151a15f

                                    SHA1

                                    583be865b92b60987828fafd78f9f5b5e740922b

                                    SHA256

                                    3c795d49379653e1b73db741ee512991ce5089c98bf191c874e9d320b804f36e

                                    SHA512

                                    14a3353acc2d32dbe67cfc012f0cc400a4f4a22a570ebb7c9fa654948df9bf74a4ca19dd807d16526b7115ae0ed288574c199fc454520be20e2f33cdc4dd2846

                                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe

                                    Filesize

                                    13KB

                                    MD5

                                    0f83fc771cbbfef7f95cb68ef1d8b7b3

                                    SHA1

                                    6f64ca26b670c3286cb109c39c049bffc202eaf3

                                    SHA256

                                    b4b252a675da42915cde3e95e1b0f65041d01f2c976ef9fe217baca5ccfc8e3f

                                    SHA512

                                    507b3823329167fb40e76c7c0c4f1469de44f63ee0c7eb6ddf5b3c5275230cf914cad69128e8ebd1efc9e6c30d8be4957de70bec43c75f94ee7b462120dd5618

                                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe

                                    Filesize

                                    8KB

                                    MD5

                                    bcef56ee6402e0e79076fcb99f4b67ef

                                    SHA1

                                    26154ec5a86682c1225da1694cee50cbfd6a4749

                                    SHA256

                                    229756c13490504d00dfb1513b2c3b65d821efeeed598fc158bb63a261901ff7

                                    SHA512

                                    3e66ca457d9798d0d47efcf32e8eb2cb8fe620cfac97571840be377385e484811f9feef45a5d6386be5cb04009022053d820cf85a6e532d2fc69ce40e6c8dcd2

                                  • C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe

                                    Filesize

                                    139KB

                                    MD5

                                    da7ba82e40c496e48e12b502087286ba

                                    SHA1

                                    c260140281e75f5d3e57077581ce91c97548738b

                                    SHA256

                                    657f831f8f69b8adf7b8c9971a08f2f628e5ea84c2c83a2091f4eea1ef87556e

                                    SHA512

                                    bacef7a362e066215a6848b5ae2bdc8954d67a59950f47f30855490558fa0f4258d2c9f2ac5dd448a64230d43f9f90d78fdbc684e25f853e3bcffcbed4f74903

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    25KB

                                    MD5

                                    718368af88a90b1467b5b28748461bde

                                    SHA1

                                    6057131857069ac4daf41e79af69ee388de86d91

                                    SHA256

                                    09262122f3a54a6f4833722a0bb2fd46d70cbca7f0b390458e3efbb1f71dedea

                                    SHA512

                                    c5952de7a6e264d7260bd1959d82ae2b6c8548e8bc91418eee64af9741868c4cef7eda54974cd123a82c72dce9c1b9776458e793037f2d60002a44c40f18040e

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    15KB

                                    MD5

                                    4dd1984009b5b727ff260df88a694294

                                    SHA1

                                    512b062c425cf935f076e33fddc8545da773eea5

                                    SHA256

                                    b4a4f5008e3d37301e7d70ee2339ce62c61e0fa37047c3e4857e3ecf10a2d67c

                                    SHA512

                                    6d541949369698d86168685ed6c8997388f18fd7e82213c9ac47643ad79da71b67138407a420dd924d7c3622dc56d89d68b0cc715a2ef76adff9b13cf3c07e93

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    48KB

                                    MD5

                                    02d15f85aa142d0aa649bf142b370a35

                                    SHA1

                                    d4981695443ec99304c6ee4676eb14808038a4ff

                                    SHA256

                                    8f5ab238564845961c6646e8b84e07efddb86ecc611be8d00a776f3bf0a37e14

                                    SHA512

                                    a10d43113d41d9a7e01d14629be18d91fe0849fca81082c94ba6dcad884c5a69b6897f9ab4a987768f186d6eba092ee7634193c2bc4ce2e1734d4dbee11e9bda

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    85KB

                                    MD5

                                    a5837628454c64dea0992dfc2cf195ee

                                    SHA1

                                    a4fca069a1f8e71c90479531e5f78ece0fc891b0

                                    SHA256

                                    c3af6a8344eb098ad1861121454083231d6e53a462eb4c233f4ac7f0575f12e5

                                    SHA512

                                    87a5514e5965aa799ee87c3f24077651c2d58f4c31725ff60c296c102a89ddd50ac2fd1bbb73ad62694d89053343a2b13ba46b7b0b02cb9a0e737adce9189115

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    55KB

                                    MD5

                                    7dec4e41e8e020c2dfbc0f848e7aacb7

                                    SHA1

                                    72857096b202b1096af43c9463488f855479345e

                                    SHA256

                                    42fe0d1ff80578ac6b4bd0c4f727b9226287d842db1180a25247f717eef3c32d

                                    SHA512

                                    98ac424d5c31dfc9d193ac8b5fab82351add800f3204b0bebbec3c48f0cdfebf18ec15962f78992af5c9945daa3f101f045790491b3e9b165190e5fd0069a3ce

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    270KB

                                    MD5

                                    c7b702dede28ca9a1e8e557c086ba6e7

                                    SHA1

                                    388091a793128cbd7514e521804a28e583b3bcbb

                                    SHA256

                                    76719684366b0d68a57b9002f4d4006b2176a2043e6f77a145dbd2d094036ffb

                                    SHA512

                                    632fb2192b1a2d21fc82b09e9950006f2b1e1196f4b76b6aed86cdb36a540b9f0777510bda9aa6f4847db1fc64dd7aad549b1298037a92038ebcef75836f871c

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    49KB

                                    MD5

                                    283f17ca750ff66f240dfe0de9b768c9

                                    SHA1

                                    052ae6113aeb38e6cb6c6133bcecc9d695b7458a

                                    SHA256

                                    ef7eaad3412f9ad12002f61a2916d1a3fc4505ee3fab7b170cde7232a80625ae

                                    SHA512

                                    25ce28aab4f0dd2806a10c7ef66a404b75ee557a507ec3b27bd76dc5cb1166620c67be2c3a83add54958bc845cf95973be4a70e7d3a11a99008847edbe5ae623

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    43KB

                                    MD5

                                    a94e7615f4c24668378a5e97d9b6b8fe

                                    SHA1

                                    b32da33cdf349c677e81c6b3d1b6777610d17568

                                    SHA256

                                    f7b7ad907f11c46a4566ad2977d4fa32c1520ddd2b3dec237462add55be83839

                                    SHA512

                                    90ec35f717769ca98a023ef35cccd773d87556ead9a5b091360d39c315591cd3395b6017bc61220f605dca97704e97cef693318ea9e3e5443517d099fbef56fb

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                    Filesize

                                    1KB

                                    MD5

                                    d35c806c95b926208b06f305860de044

                                    SHA1

                                    fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b

                                    SHA256

                                    722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061

                                    SHA512

                                    cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6

                                  • memory/748-150-0x0000000000A60000-0x0000000000B60000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/2836-101-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/3108-23-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-30-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-36-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-29-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-34-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-24-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-54-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-62-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-22-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3108-37-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/3180-123-0x0000000000830000-0x0000000000930000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/3260-52-0x0000000000400000-0x000000000065E000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/3260-46-0x0000000000400000-0x000000000065E000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/3260-66-0x0000000000400000-0x000000000065E000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/3260-51-0x0000000000400000-0x000000000065E000-memory.dmp

                                    Filesize

                                    2.4MB

                                  • memory/3288-2-0x0000000002240000-0x000000000235B000-memory.dmp

                                    Filesize

                                    1.1MB

                                  • memory/3288-1-0x0000000000630000-0x00000000006C4000-memory.dmp

                                    Filesize

                                    592KB

                                  • memory/3328-78-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/3328-77-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/3328-72-0x0000000000400000-0x0000000000406000-memory.dmp

                                    Filesize

                                    24KB

                                  • memory/3592-73-0x0000000000B80000-0x0000000000C80000-memory.dmp

                                    Filesize

                                    1024KB

                                  • memory/3592-74-0x00000000022E0000-0x00000000022E4000-memory.dmp

                                    Filesize

                                    16KB

                                  • memory/3924-21-0x00000000004D0000-0x000000000056E000-memory.dmp

                                    Filesize

                                    632KB

                                  • memory/4124-98-0x000000000091A000-0x000000000092A000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4228-175-0x000000000088E000-0x000000000089E000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4460-4-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/4460-17-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/4460-3-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/4460-6-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/4460-5-0x0000000000400000-0x0000000000537000-memory.dmp

                                    Filesize

                                    1.2MB

                                  • memory/4512-49-0x00000000005B0000-0x00000000005FB000-memory.dmp

                                    Filesize

                                    300KB

                                  • memory/4512-47-0x0000000000710000-0x0000000000810000-memory.dmp

                                    Filesize

                                    1024KB