Overview

overview

10

Static

static

f4dcaaab18...07.exe

windows7_x64

10

f4dcaaab18...07.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    26/11/2021, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f4dcaaab18f0d6dbd7c7ee3387af6607.exe
  • Size 146KB
  • Sample211126-lnrx2abfbn
  • SHA256 0a2403cf21d0e2d4a119bf0bdaf7eb36eccc2497fb64bee6004711ca4aa3c472
  • MD5 SHA1 SHA512
Score
10/10
arkeiredlinesmokeloadertofseevidarxmrig1073cheatdefaultagilenetbackdoordiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://nalirou70.top/

  • http://xacokuo80.top/

rc4.i32
rc4.i32

Extracted

Family

  • tofsee

C2

  • quadoil.ru

  • lakeflex.ru

Extracted

Family

  • redline

C2

  • 185.159.80.90:38655

  • 194.58.69.100:37026

Extracted

Family

  • arkei

Botnet

  • Default

C2

  • http://file-file-host4.com/tratata.php

Extracted

Family

  • vidar

Version

  • 48.7

Botnet

  • 1073

C2

  • https://mstdn.social/@anapa

  • https://mastodon.social/@mniami

Attributes
  • profile_id

    1073

Extracted

Family

  • redline

Botnet

  • cheat

C2

  • 95.181.152.177:21142

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata
  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Arkei Stealer Payload 2 IoCs
    stealer
  • Vidar Stealer 3 IoCs
    stealer
  • XMRig Miner Payload 1 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 28 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 13 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4dcaaab18f0d6dbd7c7ee3387af6607.exe
    "C:\Users\Admin\AppData\Local\Temp\f4dcaaab18f0d6dbd7c7ee3387af6607.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Users\Admin\AppData\Local\Temp\f4dcaaab18f0d6dbd7c7ee3387af6607.exe
      "C:\Users\Admin\AppData\Local\Temp\f4dcaaab18f0d6dbd7c7ee3387af6607.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3952
  • C:\Users\Admin\AppData\Local\Temp\ED01.exe
    C:\Users\Admin\AppData\Local\Temp\ED01.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Users\Admin\AppData\Local\Temp\ED01.exe
      C:\Users\Admin\AppData\Local\Temp\ED01.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1800
  • C:\Users\Admin\AppData\Local\Temp\F04D.exe
    C:\Users\Admin\AppData\Local\Temp\F04D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kucglvkb\
      2⤵
        PID:3704
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dnsfmhgv.exe" C:\Windows\SysWOW64\kucglvkb\
        2⤵
          PID:4236
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create kucglvkb binPath= "C:\Windows\SysWOW64\kucglvkb\dnsfmhgv.exe /d\"C:\Users\Admin\AppData\Local\Temp\F04D.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:812
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description kucglvkb "wifi internet conection"
            2⤵
              PID:1296
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start kucglvkb
              2⤵
                PID:2632
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3412
              • C:\Users\Admin\AppData\Local\Temp\F39A.exe
                C:\Users\Admin\AppData\Local\Temp\F39A.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4408
                • C:\Users\Admin\AppData\Local\Temp\F39A.exe
                  C:\Users\Admin\AppData\Local\Temp\F39A.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:652
              • C:\Users\Admin\AppData\Local\Temp\FA42.exe
                C:\Users\Admin\AppData\Local\Temp\FA42.exe
                1⤵
                • Executes dropped EXE
                PID:3972
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 492
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1900
              • C:\Windows\SysWOW64\kucglvkb\dnsfmhgv.exe
                C:\Windows\SysWOW64\kucglvkb\dnsfmhgv.exe /d"C:\Users\Admin\AppData\Local\Temp\F04D.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2748
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:2240
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                      PID:2984
                • C:\Users\Admin\AppData\Local\Temp\50CF.exe
                  C:\Users\Admin\AppData\Local\Temp\50CF.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:5060
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\50CF.exe" & exit
                    2⤵
                      PID:3584
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 5
                        3⤵
                        • Delays execution with timeout.exe
                        PID:3340
                  • C:\Users\Admin\AppData\Local\Temp\540D.exe
                    C:\Users\Admin\AppData\Local\Temp\540D.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4492
                    • C:\Users\Admin\AppData\Local\Temp\1616.exe
                      "C:\Users\Admin\AppData\Local\Temp\1616.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4608
                      • C:\Users\Admin\AppData\Local\Temp\1616.exe
                        C:\Users\Admin\AppData\Local\Temp\1616.exe
                        3⤵
                        • Executes dropped EXE
                        PID:3492
                    • C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe
                      "C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:2564
                    • C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe
                      "C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:4456
                    • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                      "C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2056
                      • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                        "{path}"
                        3⤵
                        • Executes dropped EXE
                        PID:904
                  • C:\Users\Admin\AppData\Local\Temp\591E.exe
                    C:\Users\Admin\AppData\Local\Temp\591E.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1224
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      #cmd
                      2⤵
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2964
                      • C:\Users\Admin\AppData\Roaming\Oxygen.exe
                        "C:\Users\Admin\AppData\Roaming\Oxygen.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:3576
                        • C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe
                          "C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe"
                          4⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:376
                          • C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe
                            "C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:1560
                          • C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe
                            "C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:2676
                          • C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe
                            "C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe"
                            5⤵
                            • Executes dropped EXE
                            PID:4104
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 312
                              6⤵
                              • Program crash
                              PID:4344
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fgfbv4o1.4zb.bat" "
                          4⤵
                            PID:1600
                        • C:\Users\Admin\AppData\Roaming\Kene.exe
                          "C:\Users\Admin\AppData\Roaming\Kene.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:3948
                          • C:\Windows\SysWOW64\schtasks.exe
                            "C:\Windows\System32\schtasks.exe" /Create /tn MicrosoftDriver /sc MINUTE /tr C:\Users\Admin\AppData\Local./cache./driver.exe
                            4⤵
                            • Creates scheduled task(s)
                            PID:3876
                        • C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe
                          "C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:4376
                    • C:\Users\Admin\AppData\Local\Temp\5BB0.exe
                      C:\Users\Admin\AppData\Local\Temp\5BB0.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:740
                      • C:\Users\Admin\AppData\Local\Temp\5BB0.exe
                        C:\Users\Admin\AppData\Local\Temp\5BB0.exe
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1700
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 1644
                          3⤵
                          • Program crash
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2940
                    • C:\Users\Admin\AppData\Local\cache\driver.exe
                      C:\Users\Admin\AppData\Local./cache./driver.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2204
                    • C:\Windows\System32\GamePanel.exe
                      "C:\Windows\System32\GamePanel.exe" 00000000000301F8 /startuptips
                      1⤵
                      • Checks SCSI registry key(s)
                      PID:860
                    • C:\Windows\System32\bcastdvr.exe
                      "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
                      1⤵
                      • Drops desktop.ini file(s)
                      PID:2088
                    • C:\Users\Admin\AppData\Roaming\daudfee
                      C:\Users\Admin\AppData\Roaming\daudfee
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:684
                      • C:\Users\Admin\AppData\Roaming\daudfee
                        C:\Users\Admin\AppData\Roaming\daudfee
                        2⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:3664

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          memory/376-272-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
                          Download

                          memory/376-280-0x0000000005490000-0x000000000598E000-memory.dmp
                          Download

                          memory/652-172-0x00000000057E0000-0x00000000057E1000-memory.dmp
                          Download

                          memory/652-175-0x00000000051D0000-0x00000000057D6000-memory.dmp
                          Download

                          memory/652-173-0x0000000005210000-0x0000000005211000-memory.dmp
                          Download

                          memory/652-166-0x0000000000400000-0x0000000000420000-memory.dmp
                          Download

                          memory/652-174-0x0000000005340000-0x0000000005341000-memory.dmp
                          Download

                          memory/652-181-0x00000000061B0000-0x00000000061B1000-memory.dmp
                          Download

                          memory/652-176-0x0000000005270000-0x0000000005271000-memory.dmp
                          Download

                          memory/652-184-0x0000000007570000-0x0000000007571000-memory.dmp
                          Download

                          memory/652-183-0x0000000006E70000-0x0000000006E71000-memory.dmp
                          Download

                          memory/652-177-0x00000000052B0000-0x00000000052B1000-memory.dmp
                          Download

                          memory/652-179-0x00000000055E0000-0x00000000055E1000-memory.dmp
                          Download

                          memory/740-207-0x0000000002C90000-0x0000000002C91000-memory.dmp
                          Download

                          memory/740-204-0x0000000000880000-0x0000000000881000-memory.dmp
                          Download

                          memory/740-223-0x0000000005C60000-0x0000000005CE0000-memory.dmp
                          Download

                          memory/740-219-0x00000000058B0000-0x0000000005968000-memory.dmp
                          Download

                          memory/1224-209-0x000000001C030000-0x000000001C031000-memory.dmp
                          Download

                          memory/1224-208-0x000000001DD80000-0x000000001DD81000-memory.dmp
                          Download

                          memory/1224-206-0x000000001C0B0000-0x000000001C0B2000-memory.dmp
                          Download

                          memory/1224-199-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
                          Download

                          memory/1560-296-0x0000000004810000-0x0000000004811000-memory.dmp
                          Download

                          memory/1700-227-0x0000000000400000-0x00000000004D8000-memory.dmp
                          Download

                          memory/1700-224-0x0000000000400000-0x00000000004D8000-memory.dmp
                          Download

                          memory/2240-159-0x00000000008A0000-0x00000000008B5000-memory.dmp
                          Download

                          memory/2240-161-0x00000000005B0000-0x00000000005B1000-memory.dmp
                          Download

                          memory/2240-162-0x00000000005B0000-0x00000000005B1000-memory.dmp
                          Download

                          memory/2748-165-0x0000000000400000-0x0000000000431000-memory.dmp
                          Download

                          memory/2748-164-0x0000000000550000-0x000000000069A000-memory.dmp
                          Download

                          memory/2964-210-0x0000000000400000-0x0000000000420000-memory.dmp
                          Download

                          memory/2964-220-0x0000000004D30000-0x0000000005336000-memory.dmp
                          Download

                          memory/2964-218-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
                          Download

                          memory/2964-233-0x0000000006650000-0x0000000006651000-memory.dmp
                          Download

                          memory/3056-163-0x00000000023C0000-0x00000000023D6000-memory.dmp
                          Download

                          memory/3056-122-0x00000000004D0000-0x00000000004E6000-memory.dmp
                          Download

                          memory/3576-252-0x0000000000C00000-0x0000000000C01000-memory.dmp
                          Download

                          memory/3576-278-0x00000000053E0000-0x00000000053E1000-memory.dmp
                          Download

                          memory/3696-120-0x0000000002140000-0x0000000002148000-memory.dmp
                          Download

                          memory/3696-121-0x0000000002150000-0x0000000002159000-memory.dmp
                          Download

                          memory/3952-118-0x0000000000400000-0x0000000000408000-memory.dmp
                          Download

                          memory/3972-153-0x0000000000480000-0x0000000000489000-memory.dmp
                          Download

                          memory/3972-154-0x0000000000490000-0x0000000000499000-memory.dmp
                          Download

                          memory/3972-155-0x0000000000400000-0x000000000042C000-memory.dmp
                          Download

                          memory/4104-315-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-305-0x00000000028B0000-0x00000000028B1000-memory.dmp
                          Download

                          memory/4104-304-0x00000000028F0000-0x00000000028F1000-memory.dmp
                          Download

                          memory/4104-306-0x00000000028A0000-0x00000000028A1000-memory.dmp
                          Download

                          memory/4104-308-0x00000000028D0000-0x00000000028D1000-memory.dmp
                          Download

                          memory/4104-309-0x00000000028E0000-0x00000000028E1000-memory.dmp
                          Download

                          memory/4104-307-0x00000000028C0000-0x00000000028C1000-memory.dmp
                          Download

                          memory/4104-310-0x0000000002910000-0x0000000002911000-memory.dmp
                          Download

                          memory/4104-312-0x00000000035D0000-0x00000000035D1000-memory.dmp
                          Download

                          memory/4104-313-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-314-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-319-0x0000000000780000-0x0000000000781000-memory.dmp
                          Download

                          memory/4104-318-0x0000000000790000-0x0000000000791000-memory.dmp
                          Download

                          memory/4104-321-0x00000000007A0000-0x00000000007A1000-memory.dmp
                          Download

                          memory/4104-323-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-324-0x00000000036C0000-0x00000000036C1000-memory.dmp
                          Download

                          memory/4104-325-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-326-0x0000000002840000-0x0000000002841000-memory.dmp
                          Download

                          memory/4104-322-0x0000000000800000-0x0000000000801000-memory.dmp
                          Download

                          memory/4104-320-0x00000000007C0000-0x00000000007C1000-memory.dmp
                          Download

                          memory/4104-327-0x0000000002800000-0x0000000002801000-memory.dmp
                          Download

                          memory/4104-329-0x0000000002810000-0x0000000002811000-memory.dmp
                          Download

                          memory/4104-330-0x0000000002820000-0x0000000002821000-memory.dmp
                          Download

                          memory/4104-332-0x0000000002860000-0x0000000002861000-memory.dmp
                          Download

                          memory/4104-334-0x0000000003690000-0x0000000003691000-memory.dmp
                          Download

                          memory/4104-333-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-331-0x0000000002830000-0x0000000002831000-memory.dmp
                          Download

                          memory/4104-328-0x00000000027F0000-0x00000000027F1000-memory.dmp
                          Download

                          memory/4104-317-0x00000000007D0000-0x00000000007D1000-memory.dmp
                          Download

                          memory/4104-316-0x00000000035C0000-0x00000000035C1000-memory.dmp
                          Download

                          memory/4104-297-0x0000000000600000-0x000000000074A000-memory.dmp
                          Download

                          memory/4104-311-0x0000000002900000-0x0000000002901000-memory.dmp
                          Download

                          memory/4104-335-0x0000000003690000-0x0000000003691000-memory.dmp
                          Download

                          memory/4104-337-0x0000000003690000-0x0000000003691000-memory.dmp
                          Download

                          memory/4104-338-0x0000000003690000-0x0000000003691000-memory.dmp
                          Download

                          memory/4104-339-0x0000000003690000-0x0000000003691000-memory.dmp
                          Download

                          memory/4104-336-0x0000000003690000-0x0000000003691000-memory.dmp
                          Download

                          memory/4104-340-0x0000000000760000-0x0000000000761000-memory.dmp
                          Download

                          memory/4180-132-0x0000000000660000-0x0000000000668000-memory.dmp
                          Download

                          memory/4368-138-0x00000000007C0000-0x00000000007CD000-memory.dmp
                          Download

                          memory/4368-139-0x00000000007E0000-0x00000000007F3000-memory.dmp
                          Download

                          memory/4368-140-0x0000000000400000-0x0000000000431000-memory.dmp
                          Download

                          memory/4376-261-0x0000000000E30000-0x0000000000E31000-memory.dmp
                          Download

                          memory/4376-267-0x00000000056E0000-0x00000000056E1000-memory.dmp
                          Download

                          memory/4376-279-0x00000000057A0000-0x00000000057A1000-memory.dmp
                          Download

                          memory/4408-146-0x0000000004A90000-0x0000000004B06000-memory.dmp
                          Download

                          memory/4408-147-0x00000000050E0000-0x00000000050E1000-memory.dmp
                          Download

                          memory/4408-136-0x0000000000280000-0x0000000000281000-memory.dmp
                          Download

                          memory/4408-141-0x0000000004B10000-0x0000000004B11000-memory.dmp
                          Download

                          memory/4408-143-0x0000000002700000-0x0000000002701000-memory.dmp
                          Download

                          memory/4492-191-0x0000000000580000-0x0000000000581000-memory.dmp
                          Download

                          memory/5060-193-0x0000000000490000-0x00000000004A3000-memory.dmp
                          Download

                          memory/5060-194-0x00000000004B0000-0x00000000004D1000-memory.dmp
                          Download

                          memory/5060-195-0x0000000000400000-0x0000000000437000-memory.dmp
                          Download