Overview

overview

10

Static

static

390bd3e463...bf.exe

windows7_x64

10

390bd3e463...bf.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    20/05/2021, 19:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    390bd3e463727b5545de6f128c1596bf.exe
  • Size 7.3MB
  • Sample210520-ddkdhdved2
  • SHA256 e13ba9f6e63e4013b75c3d45b012d8cbdda80913669bdd10942828b05d66e798
  • MD5 SHA1 SHA512
Score
10/10
redlinesocelarsvidar827bbs1discoveryevasioninfostealerpersistencespywarestealerupxvmprotect

Malware Config

Extracted

Family

  • vidar

Version

  • 38.7

Botnet

  • 827

C2

  • https://HAL9THapi.faceit.comramilgame

Attributes
  • profile_id

    827

Extracted

Family

  • redline

Botnet

  • BBS1

C2

  • 87.251.71.193:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 29 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 13 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Loads dropped DLL 62 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 30 IoCs
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:876
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2064
    • C:\Users\Admin\AppData\Local\Temp\390bd3e463727b5545de6f128c1596bf.exe
      "C:\Users\Admin\AppData\Local\Temp\390bd3e463727b5545de6f128c1596bf.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:788
      • C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe
        "C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1056
        • C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe
          "C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"
          3⤵
          • Executes dropped EXE
          PID:2660
      • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
        "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1736
        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1256
        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2596
      • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
        "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:1752
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
          3⤵
            PID:3024
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /im RunWW.exe /f
              4⤵
              • Kills process with taskkill
              PID:3056
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 6
              4⤵
              • Delays execution with timeout.exe
              PID:324
        • C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
          "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
          2⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1748
          • C:\Users\Admin\AppData\Roaming\8072272.exe
            "C:\Users\Admin\AppData\Roaming\8072272.exe"
            3⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2376
          • C:\Users\Admin\AppData\Roaming\8019441.exe
            "C:\Users\Admin\AppData\Roaming\8019441.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            PID:2444
            • C:\ProgramData\Windows Host\Windows Host.exe
              "C:\ProgramData\Windows Host\Windows Host.exe"
              4⤵
              • Executes dropped EXE
              PID:2724
          • C:\Users\Admin\AppData\Roaming\7076357.exe
            "C:\Users\Admin\AppData\Roaming\7076357.exe"
            3⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2512
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1684
              4⤵
              • Loads dropped DLL
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              PID:2868
        • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
          "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
          2⤵
            PID:1256
            • C:\Windows\SysWOW64\rUNdlL32.eXe
              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
              3⤵
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1672
          • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
            "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1428
            • C:\Users\Admin\AppData\Local\Temp\is-8L8NR.tmp\LabPicV3.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-8L8NR.tmp\LabPicV3.tmp" /SL5="$101B6,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:268
              • C:\Users\Admin\AppData\Local\Temp\is-74QVO.tmp\3316505.exe
                "C:\Users\Admin\AppData\Local\Temp\is-74QVO.tmp\3316505.exe" /S /UID=lab214
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                PID:2356
                • C:\Program Files\Google\XEASCQMAIW\prolab.exe
                  "C:\Program Files\Google\XEASCQMAIW\prolab.exe" /VERYSILENT
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:820
                  • C:\Users\Admin\AppData\Local\Temp\is-RER7T.tmp\prolab.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-RER7T.tmp\prolab.tmp" /SL5="$40158,575243,216576,C:\Program Files\Google\XEASCQMAIW\prolab.exe" /VERYSILENT
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:420
                • C:\Users\Admin\AppData\Local\Temp\31-d75e9-d38-877b9-c24a14e966915\Foqufashecy.exe
                  "C:\Users\Admin\AppData\Local\Temp\31-d75e9-d38-877b9-c24a14e966915\Foqufashecy.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2548
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                    6⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:2764
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1380
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:537601 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1668
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:340994 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1272
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 1388
                        8⤵
                        • Program crash
                        PID:1688
                • C:\Users\Admin\AppData\Local\Temp\0c-f531c-103-89ea7-cac8e9caec279\Babonuluno.exe
                  "C:\Users\Admin\AppData\Local\Temp\0c-f531c-103-89ea7-cac8e9caec279\Babonuluno.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1196
          • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
            "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1112
            • C:\Users\Admin\AppData\Local\Temp\is-MRCJD.tmp\lylal220.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-MRCJD.tmp\lylal220.tmp" /SL5="$101BA,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1492
              • C:\Users\Admin\AppData\Local\Temp\is-5D2VB.tmp\4_177039.exe
                "C:\Users\Admin\AppData\Local\Temp\is-5D2VB.tmp\4_177039.exe" /S /UID=lylal220
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                PID:2332
                • C:\Program Files\Google\XEASCQMAIW\irecord.exe
                  "C:\Program Files\Google\XEASCQMAIW\irecord.exe" /VERYSILENT
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2732
                  • C:\Users\Admin\AppData\Local\Temp\is-K5AUH.tmp\irecord.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-K5AUH.tmp\irecord.tmp" /SL5="$201B8,6139911,56832,C:\Program Files\Google\XEASCQMAIW\irecord.exe" /VERYSILENT
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:2460
                    • C:\Program Files (x86)\recording\i-record.exe
                      "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2080
                • C:\Users\Admin\AppData\Local\Temp\75-7347c-619-a3c85-9a2931e8a8193\Lashaetafigu.exe
                  "C:\Users\Admin\AppData\Local\Temp\75-7347c-619-a3c85-9a2931e8a8193\Lashaetafigu.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2812
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                    6⤵
                      PID:2564
                  • C:\Users\Admin\AppData\Local\Temp\04-111ed-d02-a8ca1-03d6000f529f6\Tohacuhyzho.exe
                    "C:\Users\Admin\AppData\Local\Temp\04-111ed-d02-a8ca1-03d6000f529f6\Tohacuhyzho.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2000
            • C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe
              "C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1504
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 200
                3⤵
                • Loads dropped DLL
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1404
            • C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe
              "C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe"
              2⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:2036
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /f /im chrome.exe
                3⤵
                  PID:2344
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    4⤵
                    • Kills process with taskkill
                    PID:2388

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  memory/268-127-0x0000000000240000-0x0000000000241000-memory.dmp
                  Download

                  memory/420-223-0x0000000000240000-0x0000000000241000-memory.dmp
                  Download

                  memory/420-220-0x000000006EDB1000-0x000000006EDB3000-memory.dmp
                  Download

                  memory/788-59-0x0000000075551000-0x0000000075553000-memory.dmp
                  Download

                  memory/820-215-0x0000000000400000-0x000000000043B000-memory.dmp
                  Download

                  memory/876-159-0x0000000000F70000-0x0000000000FE0000-memory.dmp
                  Download

                  memory/876-158-0x0000000000810000-0x000000000085B000-memory.dmp
                  Download

                  memory/1056-116-0x0000000000060000-0x0000000000061000-memory.dmp
                  Download

                  memory/1056-203-0x0000000000590000-0x0000000000591000-memory.dmp
                  Download

                  memory/1056-259-0x0000000000620000-0x0000000000627000-memory.dmp
                  Download

                  memory/1112-98-0x0000000000400000-0x000000000042C000-memory.dmp
                  Download

                  memory/1196-226-0x000007FEF40B0000-0x000007FEF5146000-memory.dmp
                  Download

                  memory/1196-257-0x00000000021B6000-0x00000000021D5000-memory.dmp
                  Download

                  memory/1196-227-0x00000000021B0000-0x00000000021B2000-memory.dmp
                  Download

                  memory/1404-161-0x00000000003F0000-0x00000000003F1000-memory.dmp
                  Download

                  memory/1428-99-0x0000000000400000-0x000000000046D000-memory.dmp
                  Download

                  memory/1492-128-0x0000000000240000-0x0000000000241000-memory.dmp
                  Download

                  memory/1504-129-0x0000000000400000-0x000000000065D000-memory.dmp
                  Download

                  memory/1672-153-0x0000000000360000-0x00000000003BC000-memory.dmp
                  Download

                  memory/1672-149-0x0000000010000000-0x0000000010002000-memory.dmp
                  Download

                  memory/1672-152-0x0000000002090000-0x0000000002191000-memory.dmp
                  Download

                  memory/1688-269-0x0000000000480000-0x0000000000481000-memory.dmp
                  Download

                  memory/1736-73-0x0000000001120000-0x000000000177F000-memory.dmp
                  Download

                  memory/1748-80-0x0000000000140000-0x0000000000141000-memory.dmp
                  Download

                  memory/1748-105-0x00000000002B0000-0x00000000002B1000-memory.dmp
                  Download

                  memory/1748-102-0x0000000000290000-0x00000000002AD000-memory.dmp
                  Download

                  memory/1748-119-0x000000001B040000-0x000000001B042000-memory.dmp
                  Download

                  memory/1748-90-0x0000000000280000-0x0000000000281000-memory.dmp
                  Download

                  memory/1752-148-0x0000000000400000-0x00000000004A6000-memory.dmp
                  Download

                  memory/1752-144-0x0000000001D00000-0x0000000001D97000-memory.dmp
                  Download

                  memory/2000-244-0x000007FEF40B0000-0x000007FEF5146000-memory.dmp
                  Download

                  memory/2000-256-0x0000000001F86000-0x0000000001FA5000-memory.dmp
                  Download

                  memory/2000-246-0x0000000001F80000-0x0000000001F82000-memory.dmp
                  Download

                  memory/2064-248-0x00000000028F0000-0x00000000029F6000-memory.dmp
                  Download

                  memory/2064-163-0x00000000004E0000-0x0000000000550000-memory.dmp
                  Download

                  memory/2080-254-0x000000006AB00000-0x000000006AD71000-memory.dmp
                  Download

                  memory/2080-245-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
                  Download

                  memory/2080-252-0x0000000000A00000-0x0000000000A51000-memory.dmp
                  Download

                  memory/2080-266-0x0000000000AA7000-0x0000000000AB8000-memory.dmp
                  Download

                  memory/2080-265-0x0000000000AA2000-0x0000000000AA3000-memory.dmp
                  Download

                  memory/2080-253-0x0000000065EC0000-0x0000000067271000-memory.dmp
                  Download

                  memory/2080-258-0x0000000000AA1000-0x0000000000AA2000-memory.dmp
                  Download

                  memory/2080-255-0x0000000000A01000-0x0000000000A43000-memory.dmp
                  Download

                  memory/2332-183-0x00000000004F0000-0x00000000004F2000-memory.dmp
                  Download

                  memory/2356-182-0x0000000000AD0000-0x0000000000AD2000-memory.dmp
                  Download

                  memory/2376-188-0x0000000000210000-0x0000000000211000-memory.dmp
                  Download

                  memory/2376-195-0x0000000000260000-0x0000000000261000-memory.dmp
                  Download

                  memory/2376-177-0x0000000001120000-0x0000000001121000-memory.dmp
                  Download

                  memory/2376-193-0x0000000000480000-0x00000000004BC000-memory.dmp
                  Download

                  memory/2376-206-0x0000000000280000-0x0000000000281000-memory.dmp
                  Download

                  memory/2444-196-0x0000000000360000-0x0000000000370000-memory.dmp
                  Download

                  memory/2444-181-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                  Download

                  memory/2444-202-0x0000000000B40000-0x0000000000B41000-memory.dmp
                  Download

                  memory/2444-198-0x0000000000370000-0x0000000000371000-memory.dmp
                  Download

                  memory/2444-189-0x0000000000340000-0x0000000000341000-memory.dmp
                  Download

                  memory/2460-234-0x000000006EBD1000-0x000000006EBD3000-memory.dmp
                  Download

                  memory/2460-236-0x0000000000240000-0x0000000000241000-memory.dmp
                  Download

                  memory/2512-190-0x0000000000260000-0x0000000000261000-memory.dmp
                  Download

                  memory/2512-197-0x0000000000430000-0x0000000000431000-memory.dmp
                  Download

                  memory/2512-204-0x00000000021F0000-0x00000000021F1000-memory.dmp
                  Download

                  memory/2512-186-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
                  Download

                  memory/2512-194-0x0000000000660000-0x000000000069A000-memory.dmp
                  Download

                  memory/2548-224-0x0000000002000000-0x0000000002002000-memory.dmp
                  Download

                  memory/2660-262-0x0000000000400000-0x000000000041C000-memory.dmp
                  Download

                  memory/2660-260-0x0000000000400000-0x000000000041C000-memory.dmp
                  Download

                  memory/2660-264-0x0000000004D20000-0x0000000004D21000-memory.dmp
                  Download

                  memory/2724-200-0x0000000000B50000-0x0000000000B51000-memory.dmp
                  Download

                  memory/2724-209-0x0000000004A30000-0x0000000004A31000-memory.dmp
                  Download

                  memory/2732-231-0x0000000000400000-0x0000000000414000-memory.dmp
                  Download

                  memory/2812-243-0x0000000000B20000-0x0000000000B22000-memory.dmp
                  Download

                  memory/2868-247-0x0000000000270000-0x000000000029E000-memory.dmp
                  Download