djvu | 41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a

Analysis

max time kernel
296s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
06/03/2024, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
Size

758KB
MD5

7ca5059361472925999d587e48f3d882
SHA1

4f6773d6e6ee16e6bcab8c3bacc38a3099f0995a
SHA256

41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a
SHA512

ea10b262d125d5dc9c837dbb910897157a49fc1488605e66c1bc73f4545aa26e133702b9dd6cdf6ab0a211b3cd9b004b19aa12ca448e5a236330819b4cbf949a
SSDEEP

12288:LKEwtE96Il33pXB0J04YheY4MH9v7vmgFc5LhKyjrcakNS6zqt0hVK:LKpy96IFBB0JAsHMH9vFcznrcaqhzqW

Score

10^/10

djvu vidar e2da5861d01d391b927839bbec00e666 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://sajdfue.com/test1/get.php

Attributes

extension
.wisz
offline_id
4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.1

Botnet

e2da5861d01d391b927839bbec00e666

https://steamcommunity.com/profiles/76561199649267298

https://t.me/uprizin

Attributes

profile_id_v2
e2da5861d01d391b927839bbec00e666
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 OPR/96.0.0.0

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/4948-48-0x0000000000400000-0x0000000000645000-memory.dmp	family_vidar_v7
behavioral2/memory/3112-51-0x0000000003A50000-0x0000000003A82000-memory.dmp	family_vidar_v7
behavioral2/memory/4948-53-0x0000000000400000-0x0000000000645000-memory.dmp	family_vidar_v7
behavioral2/memory/4948-54-0x0000000000400000-0x0000000000645000-memory.dmp	family_vidar_v7
behavioral2/memory/4948-66-0x0000000000400000-0x0000000000645000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 16 IoCs

resource	yara_rule
behavioral2/memory/704-1-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/704-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3904-4-0x0000000003830000-0x000000000394B000-memory.dmp	family_djvu
behavioral2/memory/704-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/704-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/704-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1216-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3112	build2.exe
4948	build2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2108	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-682446400-748730298-2471801445-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\106f2736-e73a-468d-9bab-fda73f48e633\\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe\" --AutoStart"	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
10	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3904 set thread context of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 580 set thread context of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 3112 set thread context of 4948	3112	build2.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
664	4948	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
1216	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
1216	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 3904 wrote to memory of 704	3904	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	74
PID 704 wrote to memory of 2108	704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	75
PID 704 wrote to memory of 2108	704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	75
PID 704 wrote to memory of 2108	704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	75
PID 704 wrote to memory of 580	704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	76
PID 704 wrote to memory of 580	704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	76
PID 704 wrote to memory of 580	704	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	76
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 580 wrote to memory of 1216	580	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	78
PID 1216 wrote to memory of 3112	1216	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	79
PID 1216 wrote to memory of 3112	1216	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	79
PID 1216 wrote to memory of 3112	1216	41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe	79
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80
PID 3112 wrote to memory of 4948	3112	build2.exe	80

C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
"C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
  "C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\106f2736-e73a-468d-9bab-fda73f48e633" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
    "C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:580
  - - C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe
      "C:\Users\Admin\AppData\Local\Temp\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Users\Admin\AppData\Local\b5c43924-269b-4770-b552-d920282b4da9\build2.exe
        
        "C:\Users\Admin\AppData\Local\b5c43924-269b-4770-b552-d920282b4da9\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3112
      - C:\Users\Admin\AppData\Local\b5c43924-269b-4770-b552-d920282b4da9\build2.exe
        
        "C:\Users\Admin\AppData\Local\b5c43924-269b-4770-b552-d920282b4da9\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 768
        7⤵
        Program crash
        
        PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1cfc0a1560c8a6b64e4cdc5c2f8477c6

SHA1
0ce75dede00bf389dcd14b4c82f2c0b6f9edb2a3

SHA256
1aff5542b26102a183b6f0922d1cb3c3b07a32da9f7caf861fb1c0872ea037de

SHA512
06ec8042bb4d1de870c19f958d576689cf0fac592211d2cf08a7f09065e615e79b6e2d17e4f5832919c5b57b9ee507500bf415d3747b775f0d8388eb5da7aaf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0dc8708d1b10f0454d3f58117825b5de

SHA1
154ce207dc7a83b2ff58f2553da6beaecb071d9e

SHA256
acc9dd68bcbdaadf18b3db9299b585f3d68e8b7b126221bdec3f310a6aef6e69

SHA512
dd804290b38cbc15e07eb82b22538a736bc0212e79b4b4c33c22ec1458f97444374992626bba2a3bc02cd9be0568f099018aa869f18fc198285559398a147145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
d2049aeff577fd9efd8f58aeeae55f4d

SHA1
fd5fc1f14f06e2ab31a1e996cb14ec3878525ac9

SHA256
2a6e48b1e08bd62cea41e42915b02a05c0b15ec0ba17e35d7ddd76001d2a550f

SHA512
991f015a5ed033ea9826b2295886498c587053cb7787d900208d1d8ff8e8d68c49d4768caa686dd1db8d4eebf9c0ad14b2876b1cfda8385d41fe778a1b11e81f

Download Submit
C:\Users\Admin\AppData\Local\106f2736-e73a-468d-9bab-fda73f48e633\41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a.exe

Filesize
758KB

MD5
7ca5059361472925999d587e48f3d882

SHA1
4f6773d6e6ee16e6bcab8c3bacc38a3099f0995a

SHA256
41829aa6bf99f391c6f11c6713f93a45b71aeec09a38c8a34cb31fa2acab595a

SHA512
ea10b262d125d5dc9c837dbb910897157a49fc1488605e66c1bc73f4545aa26e133702b9dd6cdf6ab0a211b3cd9b004b19aa12ca448e5a236330819b4cbf949a

Download Submit
C:\Users\Admin\AppData\Local\b5c43924-269b-4770-b552-d920282b4da9\build2.exe

Filesize
219KB

MD5
d37b17fc3b9162060a60cd9c9f5f7e2c

SHA1
5bcd761db5662cebdb06f372d8cb731a9b98d1c5

SHA256
36826a94f7aabd1f0d71abc6850e64a499768bd30cab361e8724d546e495e35f

SHA512
04b0fcc597afba17b8be46eacee58c7e8d38c7efa9247ab5b3cbf1ae3ed8dc2e6e909b7dab28b2a41f08fb37e950abb6ca97553adf0e20335c6864d942bef6ea

Download Submit
C:\Users\Admin\AppData\Local\b5c43924-269b-4770-b552-d920282b4da9\build3.exe

Filesize
1KB

MD5
106dc121df377c0e9ce1da2a34903c2b

SHA1
adc752099c7940108974193f32d53e871cae30c8

SHA256
ee2a8bc950324dd2b44c157097c8d657a74d3e9b5518076ca0ef6e8b1c0f2657

SHA512
803838c35c6d800114d76de7e26549a18dd605cbf246aa9d4ae1332c0e1ce6cb6ac16944c97bbcfdf97a207f0f7bdec34aadc67169b8e5e03ca8ec544300ee68

Download Submit
memory/580-20-0x0000000001BC0000-0x0000000001C5D000-memory.dmp

Filesize
628KB

Download
memory/704-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/704-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/704-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/704-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/704-1-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1216-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3112-51-0x0000000003A50000-0x0000000003A82000-memory.dmp

Filesize
200KB

Download
memory/3112-49-0x00000000021B0000-0x00000000022B0000-memory.dmp

Filesize
1024KB

Download
memory/3904-4-0x0000000003830000-0x000000000394B000-memory.dmp

Filesize
1.1MB

Download
memory/3904-2-0x0000000003730000-0x00000000037C7000-memory.dmp

Filesize
604KB

Download
memory/4948-53-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4948-54-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4948-48-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download
memory/4948-66-0x0000000000400000-0x0000000000645000-memory.dmp

Filesize
2.3MB

Download