Malware Analysis Report

2024-10-19 01:46

Sample ID 240729-2yy24avdpp
Target setup.exe
SHA256 be65a8d884dbb5c292c2ae94591cc6c86909bcd7ddb42588932afaf9ce15728e
Tags
djvu discovery ransomware persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

be65a8d884dbb5c292c2ae94591cc6c86909bcd7ddb42588932afaf9ce15728e

Threat Level: Known bad

The file setup.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery ransomware persistence

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-29 23:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-29 23:00

Reported

2024-07-29 23:02

Platform

win7-20240704-en

Max time kernel

141s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1244 set thread context of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\setup.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1244 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe
PID 2300 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 264

Network

N/A

Files

memory/1244-0-0x0000000000540000-0x00000000005D2000-memory.dmp

memory/1244-1-0x0000000000540000-0x00000000005D2000-memory.dmp

memory/1244-2-0x00000000023B0000-0x00000000024CB000-memory.dmp

memory/2300-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2300-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2300-9-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2300-7-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-29 23:00

Reported

2024-07-29 23:03

Platform

win10v2004-20240709-en

Max time kernel

144s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e5c8ba52-7908-4e67-9901-465cc4342d70\\setup.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1080 set thread context of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 set thread context of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 1080 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 780 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\icacls.exe
PID 780 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\icacls.exe
PID 780 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SysWOW64\icacls.exe
PID 780 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 780 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 780 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe
PID 4712 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Users\Admin\AppData\Local\Temp\setup.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\e5c8ba52-7908-4e67-9901-465cc4342d70" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.67:80 c.pki.goog tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 uaery.top udp
US 8.8.8.8:53 zexeq.com udp
DE 188.40.141.211:80 zexeq.com tcp
DE 188.40.141.211:80 zexeq.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 211.141.40.188.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp

Files

memory/1080-1-0x0000000001F50000-0x0000000001FE9000-memory.dmp

memory/1080-2-0x00000000020D0000-0x00000000021EB000-memory.dmp

memory/780-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/780-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/780-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/780-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\e5c8ba52-7908-4e67-9901-465cc4342d70\setup.exe

MD5 13fd90197ba55324bd01b9fa97f5295a
SHA1 313ac91a6ea6e75c0fe75f65d1254905491b59f6
SHA256 be65a8d884dbb5c292c2ae94591cc6c86909bcd7ddb42588932afaf9ce15728e
SHA512 a2d7a2b666f712b57f1cbed89598ad783589b93d4e0b67ccbe5d8ac4f8b3faf18c704a5606953319090dbf974f5cd9bc600ee3b7695c47cc92db5d9a8227f6fb

memory/780-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4712-21-0x0000000000400000-0x0000000000539000-memory.dmp

memory/4712-23-0x0000000000400000-0x0000000000539000-memory.dmp

memory/4336-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-26-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 534746d3effe3b93ef39b67deb99ca63
SHA1 3c35f00af0d137b74bdd95cd16df9cd56f1b1bba
SHA256 f1d78cfeeb05cde3e1fe39bdd9174bcbcb3e58bba08b906c098d233887c49e5d
SHA512 52b8eeecf7cf8dd00f771110fc2368c68cb0afc4deb78a984c14c17f8f451f35c1dbe2bce72b18b8eb69908989ec50316cd1a1fd10f1d9f3802d9f77167205a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 49c5ea079f6bf0dec94f9249c49c72e7
SHA1 04cf5ed84abc142513e5ad546fa51488991d1dc0
SHA256 21e4a339f8627abb873081c5337df3318a29a742310095f36fe0c90016830c18
SHA512 d7afde8f500aa3bc92c1e494cf1b1d2c48b59615debc7ca74d8f58fa97587c9d2079e3cbe2601aadb30a240e9b62279652573569cf9382cb8da028501584f5f4

memory/4336-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-34-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\b831645d-3653-4acb-8855-9538812baf2b\build3.exe

MD5 6910426a598bc0b07dd6ca7c2faf5c22
SHA1 4304d65a08652b167453997e1464cc6ef034be23
SHA256 ebfef207462c29030b8a06068c8cbf1cfeae1304813b9cdbfa2d705b314bf692
SHA512 5e96757fa5daa336968aa07d5fe5525040a081a547dd6bad55bed4539ad76b3f96aabd38f461efdafa4a427963b2a3187cc40dfa60c74e6c6ddf738176381952

memory/4336-49-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-55-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\bowsakkdestx.txt

MD5 caa078f0348cda98328127c142e3bfed
SHA1 e38274d642c806a3affcca8f7e37b61f591c47e6
SHA256 91faeb982f34313750a83d74c5464abe4e01357d1a7ea4253973509bc0e9d219
SHA512 2e6a5c482b5226079c6b4bd9a706537c372a3b43962f64be6bdd281e3217f963316ef0eba38164890bdf14af6558eb26605320487f0a0c841be9bb813c2ee5d6

memory/4336-66-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-68-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-69-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-70-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4336-72-0x0000000000400000-0x0000000000537000-memory.dmp