Overview

overview

10

Static

static

3

buildz.exe

windows7-x64

10

buildz.exe

windows10-1703-x64

10

buildz.exe

windows10-2004-x64

10

buildz.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    593s
  • max time network
    582s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 20:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    buildz.exe

  • Size

    728KB

  • MD5

    1ac225bc36c31f9209f984210bd68469

  • SHA1

    b43db3c1f19bca6b35e91ee88edf8c80d4e6c422

  • SHA256

    d69f5817cc5eadb99b3a8b0f87ca4a471c052f151f14180955f14ad78a1acacc

  • SHA512

    e99727b0b993b6911b402eb48c85eb81dd10b76894eabaad196618558f643ab6dd2e5c1a5d393e1537b089fdfdbe1d778c88f62fb0abd9384b461521422e53a3

  • SSDEEP

    12288:yCLwobUsKbD6axHJhie99gldRoo+uoagdWip+KSN7uO7/:yYsmaZJwAglLoo+5WioKSN7ue/

Score
10/10
djvuvidar5739ef2bbcd39fcd59c5746bfe4238c5discoverypersistenceransomwarestealer

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.6

Botnet

5739ef2bbcd39fcd59c5746bfe4238c5

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok
Attributes
  • profile_id_v2

    5739ef2bbcd39fcd59c5746bfe4238c5

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detected Djvu ransomware 22 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\buildz.exe
    "C:\Users\Admin\AppData\Local\Temp\buildz.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Users\Admin\AppData\Local\Temp\buildz.exe
      "C:\Users\Admin\AppData\Local\Temp\buildz.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\18f04a9c-a910-4191-9c2f-804e5d480911" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2748
      • C:\Users\Admin\AppData\Local\Temp\buildz.exe
        "C:\Users\Admin\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Users\Admin\AppData\Local\Temp\buildz.exe
          "C:\Users\Admin\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4492
          • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe
            "C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1872
            • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe
              "C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe"
              6⤵
              • Executes dropped EXE
              PID:1956
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 2180
                7⤵
                • Program crash
                PID:4760
          • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build3.exe
            "C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3088
            • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build3.exe
              "C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1516
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:4112
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1956 -ip 1956
    1⤵
      PID:2320
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1500
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          3⤵
          • Creates scheduled task(s)
          PID:384
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2624
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:4576
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1988
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:3088
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2764
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:3864
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2028
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:4956
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:740
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:2568
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:4868
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:3312
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:3780
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:2360
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1808
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:4676
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      PID:3752

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      1KB

      MD5

      4887e5c213b9a196b1e5f9bdc16f8048

      SHA1

      e8e9d7e44f6702e33a44e8ce90518500392dbc47

      SHA256

      10d47f70b1a3a7f9112bd231bcaede46d39be5480c61a6fbc1fc45cae8788880

      SHA512

      9c74a4bcfa65a82d3bb0c78ed02e2c8dab502c21fedfebd613fa3e89e6c50ebf8b290e82a3a7ae9fb77f8877aa50e217ab1a0207518253681f9379855b0d30e8

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      724B

      MD5

      8202a1cd02e7d69597995cabbe881a12

      SHA1

      8858d9d934b7aa9330ee73de6c476acf19929ff6

      SHA256

      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

      SHA512

      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      410B

      MD5

      bc0b515e5885b2f37cab1b5c1d0bcf8e

      SHA1

      6c003ddaafcedcf24c456209b578e86dc4a57e37

      SHA256

      c5868b5a836295ec9916ae9fc04e060a8933f606d5642df7229f226af731a4d9

      SHA512

      9c80cf52d9de2e1a19438159633b589a23878a6b366815228ca0b74ea4c0c0d10a78799cfc4a9fe06d78a088fccb457aa756792e92f4b74abdc7721e01b2bce7

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      392B

      MD5

      d14c681eb925f801d5640f88567a46ac

      SHA1

      1718395cc42105ffe91d22ea6e7de936fc00e55b

      SHA256

      b19ab2b895fb9a25ed7f2a8e6e7743a6244e217a2841a2ebdf5905ce5b71e5c4

      SHA512

      6d4e9fc1bdad6eaaf99a8728db782bf6a5aadf068b82ce72ce292bfb2971ea0e8090abd98d7bb643206cebcffe44905e9fc73d97a89644626af4c5968fdd412c

      Download Submit

    • C:\Users\Admin\AppData\Local\18f04a9c-a910-4191-9c2f-804e5d480911\buildz.exe
      Filesize

      452KB

      MD5

      1c44378dadea64b7bc670ed5672f5ca5

      SHA1

      671f4abd83245c483dabe7943bfec04fcaab20de

      SHA256

      2f44a9659262111c45fa70370020ba5a49164812de972fb04213aeb567c7f30e

      SHA512

      6781d1f9fbfaeffb6350103d88eebdc3a07f0ea7b776ea028b1599cabdeb0da5e912faa7267f576653c3c7dc6d28dc8638ebba8041e04bae9c72ca07fe8b6611

      Download Submit

    • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe
      Filesize

      199KB

      MD5

      be5ac2e21d377c002e14b3b700c70497

      SHA1

      15ab20141979fcb2cf7b6a5b722fce39597fac75

      SHA256

      15ef0e1867fb25b56b60d422299a2e9517dba524216d1c98b1714c2a8be58f35

      SHA512

      ac2013929e833261ae9c55b50cf961077d0c66dfd5c45e20e69dddb06f6dbbf3111313f41c21b2f347df1fbc9e759dc97d33d2fdf21325d0dad2d729219a1280

      Download Submit

    • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe
      Filesize

      165KB

      MD5

      c2ce5fa3c896eb366917d699a9a26be7

      SHA1

      96c4dc6c9d151453181bc878e17c24908cb2364f

      SHA256

      4717df297fd7e74523dd7bd423e74bf628a6d18fd9486bd2be4446e8d8b2963d

      SHA512

      68bfb7822a41a5d453e01b55500f971edca605cc741770df4385dc8301e0a2954e7cc05fc3298b60b3725e942e4a06e8bbf13a9af087c10de6ea95ba2599615a

      Download Submit

    • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe
      Filesize

      277KB

      MD5

      8dae8b6a6be6e3527183594d1c26a2d3

      SHA1

      b87e40cee60869a36e79c88c8a3a34baf0bc4889

      SHA256

      afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

      SHA512

      0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e

      Download Submit

    • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build2.exe
      Filesize

      22KB

      MD5

      2c911bd2ea54267efa03ada6297a1d8e

      SHA1

      36a803405120e54254b3d7aafb4b5080005e1719

      SHA256

      d125a9f1c192fc1686a37524b9885833097c606756519f2a35cf0e6a8c569af4

      SHA512

      7ed00c4eb52e0ce98120418ae95e8f40fefd67715b9c1db662215f1e34a03a657c4dc5fbefc6a4a1bb35b97c4a4a66c742e828233ec565df9e72cca0fb99e57e

      Download Submit

    • C:\Users\Admin\AppData\Local\e63c6ece-fc5e-4776-83ee-c55720d3f65f\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      25KB

      MD5

      c74298160a01b3a99a43013d30002859

      SHA1

      7881a27741bbaeb8911fbb527e3d91a357ba6772

      SHA256

      e7558117be59e8ac442eca1ed325cbdc7769fc7a94ede181b620cc6ad8924609

      SHA512

      955311d73aa042a4ff106d2f07d43cbbb4dfcd66040e49966f1236f22fc0ddd47794c02b1e6201be0b6ab4c882dc0bc050e05215a69f0c4504cc8e9341309982

      Download Submit

    • memory/740-208-0x0000000000880000-0x0000000000980000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/740-213-0x0000000000880000-0x0000000000980000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1132-5-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/1132-17-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/1132-3-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/1132-4-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/1132-6-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/1516-88-0x0000000000410000-0x00000000004D9000-memory.dmp

      Filesize

      804KB

      Download

    • memory/1516-87-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1516-85-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1516-80-0x0000000000400000-0x0000000000406000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1808-266-0x0000000000870000-0x0000000000970000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1872-50-0x00000000007A0000-0x00000000008A0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1872-52-0x00000000006D0000-0x0000000000701000-memory.dmp

      Filesize

      196KB

      Download

    • memory/1944-105-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1944-100-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1956-73-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1956-54-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1956-55-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1956-49-0x0000000000400000-0x0000000000644000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/1988-140-0x0000000000850000-0x0000000000950000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2028-181-0x0000000000960000-0x0000000000A60000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2624-119-0x0000000000870000-0x0000000000970000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2764-170-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2764-160-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3088-83-0x000000000099D000-0x00000000009AD000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3088-84-0x0000000000830000-0x0000000000834000-memory.dmp

      Filesize

      16KB

      Download

    • memory/3752-20-0x0000000002220000-0x00000000022B5000-memory.dmp

      Filesize

      596KB

      Download

    • memory/3780-256-0x0000000000A50000-0x0000000000B50000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3780-246-0x0000000000A50000-0x0000000000B50000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4492-71-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-22-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-37-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-34-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-24-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-76-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-29-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-23-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-30-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4492-36-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/4868-223-0x00000000009D0000-0x0000000000AD0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5000-1-0x0000000002360000-0x00000000023FF000-memory.dmp

      Filesize

      636KB

      Download

    • memory/5000-2-0x0000000002400000-0x000000000251B000-memory.dmp

      Filesize

      1.1MB

      Download