Overview

overview

10

Static

static

10

134ca8f486...57.exe

windows7-x64

10

134ca8f486...57.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02-02-2023 23:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    134ca8f486c3a509bf3c82b7e41ce1af2a698fb8bf5fd1c9ee267b2ac7f21457.exe

  • Size

    12.0MB

  • MD5

    a067491773524cf499e7a0bc77ceec96

  • SHA1

    e8034dfd3468dcd3d5a6d09f3fde7f63dcc9ec13

  • SHA256

    134ca8f486c3a509bf3c82b7e41ce1af2a698fb8bf5fd1c9ee267b2ac7f21457

  • SHA512

    c759d0ace38c842f98d4a9d4a8cc342c89d40ab4238ff52625db13a4e50714aedf701798f6ea22e755e3599c4e002b4ba49ed3f9b06c56e4d95ac7ce6800fa4c

  • SSDEEP

    98304:QnLu1TIRtUOV5ZQ+5jZArLu1OWWqXpy05QP:QnTRtBYk405QP

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Readme_Instructions.html

Ransom Note
<!DOCTYPE HTML> <html><head><title>infected with ransomware virus</title> <meta http-equiv="X-UA-Compatible" content="IE=edge"> </head> <body style="margin: 0.4em; font-size: 14pt;"><p>!!!&nbsp; &nbsp; Your files are encrypted&nbsp; !!!<br><br>*All your files are protected with encryption*<br>*There is no public decryption software.*<br>*All files/documents/software with ".CRYPT" extension is encrypted*<br><br><br>###### Program and private key, What is the price? The price depends on how fast you can pay us.!######<br>1 day : 50 Bitcoin<br>2 day : 60 Bitcoin<br>3 day : 90 Bitcoin<br>4 day : 130 Bitcoin<br> 5 day&nbsp; &nbsp; : permanent data loss !!!!<br><br> ***How to contact our team through tox chat***<br><br>*Download tox chat from<br>*<a href="https://tox.chat/download.html">https://tox.chat/download.html</a><br>*send us friend request to tox chat id <br><br>7D8796EB86CBF29F53F8A8447EABAF310ED898D9DEFF97AE09C1864C2A6B3B14ED8F82AE9B9D<br><br>*Our team is waiting*<br><br>!!!!For immediate decryption!!!<br><br>write to our email:<br><br><a href="mailto:decryptorsoftware@xyzmailpro.com">decryptorsoftware@xyzmailpro.com</a><br><br> *After payment received, we will send private key to your IT department.!!!*<br><br> *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.*<br><br>!!! We have downloaded all your files to our servers and will release data if you do not comply.!!!<br>!!! Do not attempt to decrypt your data using third-party software, this will result in permanent data loss.!!!</p></body></html>
Emails

href="mailto:decryptorsoftware@xyzmailpro.com">decryptorsoftware@xyzmailpro.com</a><br><br>

URLs

http-equiv="X-UA-Compatible"

Extracted

Path

C:\Users\Admin\Desktop\Readme_Instructions.html

Ransom Note
!!! Your files are encrypted !!! *All your files are protected with encryption* *There is no public decryption software.* *All files/documents/software with ".CRYPT" extension is encrypted* ###### Program and private key, What is the price? The price depends on how fast you can pay us.!###### 1 day : 50 Bitcoin 2 day : 60 Bitcoin 3 day : 90 Bitcoin 4 day : 130 Bitcoin 5 day : permanent data loss !!!! ***How to contact our team through tox chat*** *Download tox chat from *https://tox.chat/download.html *send us friend request to tox chat id 7D8796EB86CBF29F53F8A8447EABAF310ED898D9DEFF97AE09C1864C2A6B3B14ED8F82AE9B9D *Our team is waiting* !!!!For immediate decryption!!! write to our email:decryptorsoftware@xyzmailpro.com *After payment received, we will send private key to your IT department.!!!* *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* !!! We have downloaded all your files to our servers and will release data if you do not comply.!!! !!! Do not attempt to decrypt your data using third-party software, this will result in permanent data loss.!!!
Emails

email:decryptorsoftware@xyzmailpro.com

Signatures

  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\134ca8f486c3a509bf3c82b7e41ce1af2a698fb8bf5fd1c9ee267b2ac7f21457.exe
    "C:\Users\Admin\AppData\Local\Temp\134ca8f486c3a509bf3c82b7e41ce1af2a698fb8bf5fd1c9ee267b2ac7f21457.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E8F5D795-5C3A-4769-A0A2-D3487F70F069}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E8F5D795-5C3A-4769-A0A2-D3487F70F069}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:520
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B618271D-B239-482D-AFD5-7A50C9A50BAE}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B618271D-B239-482D-AFD5-7A50C9A50BAE}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1204
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DA422079-C14A-49DA-B3EC-82273B6CF696}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DA422079-C14A-49DA-B3EC-82273B6CF696}'" delete
        3⤵
          PID:900
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{734396EA-1826-43DB-B98D-E35D8F7D9CC2}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{734396EA-1826-43DB-B98D-E35D8F7D9CC2}'" delete
          3⤵
            PID:1960
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{30A33652-DC7F-4339-ABB7-817FF1FBC717}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{30A33652-DC7F-4339-ABB7-817FF1FBC717}'" delete
            3⤵
              PID:1640
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A5A770FD-9640-457C-8524-28B99A08B1DD}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1000
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A5A770FD-9640-457C-8524-28B99A08B1DD}'" delete
              3⤵
                PID:1632
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{99C8D04A-818D-4A47-B362-485EB73813BD}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1756
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{99C8D04A-818D-4A47-B362-485EB73813BD}'" delete
                3⤵
                  PID:1128
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{77837457-EA6F-4186-BFB1-35A1E4FB5AC8}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:652
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{77837457-EA6F-4186-BFB1-35A1E4FB5AC8}'" delete
                  3⤵
                    PID:624
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F046BF2-0712-465A-AA1F-BED0DAC14995}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1708
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F046BF2-0712-465A-AA1F-BED0DAC14995}'" delete
                    3⤵
                      PID:588
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{42C454BB-4ECD-4764-9CA9-EA47C9016450}'" delete
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1924
                    • C:\Windows\System32\wbem\WMIC.exe
                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{42C454BB-4ECD-4764-9CA9-EA47C9016450}'" delete
                      3⤵
                        PID:1084
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4251BF33-9FB5-485E-9DD2-2AA975A61DA3}'" delete
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:960
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4251BF33-9FB5-485E-9DD2-2AA975A61DA3}'" delete
                        3⤵
                          PID:1092
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F5BE2DB2-82FB-45CC-A7AE-B6E48AF616B0}'" delete
                        2⤵
                          PID:576
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F5BE2DB2-82FB-45CC-A7AE-B6E48AF616B0}'" delete
                            3⤵
                              PID:1516
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E3EA34D6-0D83-420F-9FDB-BCB8B282ABD3}'" delete
                            2⤵
                              PID:1676
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E3EA34D6-0D83-420F-9FDB-BCB8B282ABD3}'" delete
                                3⤵
                                  PID:1484
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C7453FC-F46B-48FE-953C-7C693DE44F6C}'" delete
                                2⤵
                                  PID:360
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C7453FC-F46B-48FE-953C-7C693DE44F6C}'" delete
                                    3⤵
                                      PID:1072
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A19866EC-B042-4C15-8E3B-C50FE041BDA6}'" delete
                                    2⤵
                                      PID:1520
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A19866EC-B042-4C15-8E3B-C50FE041BDA6}'" delete
                                        3⤵
                                          PID:1100
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4F203A0-643F-44F5-B71A-61C6A2753C7F}'" delete
                                        2⤵
                                          PID:1988
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4F203A0-643F-44F5-B71A-61C6A2753C7F}'" delete
                                            3⤵
                                              PID:1712
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4A230E8-3D41-4EEA-BF73-3F5BFAFE1A25}'" delete
                                            2⤵
                                              PID:776
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4A230E8-3D41-4EEA-BF73-3F5BFAFE1A25}'" delete
                                                3⤵
                                                  PID:580
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D39A855D-FA6E-419D-A76F-8E1FFB870B4F}'" delete
                                                2⤵
                                                  PID:452
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D39A855D-FA6E-419D-A76F-8E1FFB870B4F}'" delete
                                                    3⤵
                                                      PID:976
                                                • C:\Windows\system32\vssvc.exe
                                                  C:\Windows\system32\vssvc.exe
                                                  1⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1804
                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Readme_Instructions.html
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1768
                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
                                                    2⤵
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1072

                                                Network

                                                MITRE ATT&CK Matrix ATT&CK v6

                                                Initial Access

                                                Execution

                                                Persistence

                                                Privilege Escalation

                                                Defense Evasion

                                                Modify Registry

                                                1
                                                T1112

                                                Credential Access

                                                Credentials in Files

                                                1
                                                T1081

                                                Discovery

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                1
                                                T1005

                                                Exfiltration

                                                Command and Control

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0C0B41E1-A357-11ED-B51C-6E705F4A26E5}.dat
                                                  Filesize

                                                  5KB

                                                  MD5

                                                  3b9b56f2f7434887868f6bf2b9debfba

                                                  SHA1

                                                  ee0c003817f76bf46c9c4dcb07caebc8adcc9722

                                                  SHA256

                                                  194a52c1744c141b68157fc3580bc82f054f83a1ab69662230ba409e74513787

                                                  SHA512

                                                  43179b04b366e7278f00d4b4ee1b8a4162bcca5fcffd00cb19f6d7927364bee0fda37d3decd3d5f09a4dbf79dd84e74188a649ccdc9019578f639e0ca2721d19

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C0B41E3-A357-11ED-B51C-6E705F4A26E5}.dat
                                                  Filesize

                                                  4KB

                                                  MD5

                                                  ac87f5ea117a39c0815afcf69bc2a121

                                                  SHA1

                                                  41123f04199c03a069518eff6da76b1ed1e741b3

                                                  SHA256

                                                  f0dfe6cd13670f29b9a495d4d3294e21b32997fe3fc03fde4190fb3f2b24a48f

                                                  SHA512

                                                  71e1b4754b1011adeea424f9d12ad33fbce5d7c555d55deadf3568c105fdee929fa95f6bcae3c252d22b683a7803c374b42c306f0b22c90bdfd98419f61accd4

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C0B41E4-A357-11ED-B51C-6E705F4A26E5}.dat
                                                  Filesize

                                                  3KB

                                                  MD5

                                                  e86a246535e7300419c1ca182fde46ab

                                                  SHA1

                                                  a59b474bba2ec981a71507d1eebf02eb292dff4c

                                                  SHA256

                                                  75d14031bd101e89577fa60ce36d5dcf4240bfb4dc904393dea5f6d267929ded

                                                  SHA512

                                                  7e8760eaa46516c4d355ac3ae3006835f525416c8bb679936a2782cc91f44cbd25347071d6a6ff855432172c7f3079af2f2492d840a6149c34cdfb0bf3f86d09

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Readme_Instructions.html
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  9ae54b4efc9f30245782c6001f69b120

                                                  SHA1

                                                  3de64c5e9732699b76510728e43f408c131a995e

                                                  SHA256

                                                  cef2395cc2ae718f07b84bdbae435752c0e7049aa6de8488ab045c07f5fd0b37

                                                  SHA512

                                                  fbbb0e2bf0d11756dba1d9bf0183a2f0ec94ee729d97740ed3ba47b3f99922188fc04fdbc255f51a3544fa3bfc7ed588d3aabb45de0ed59ed96ce6d15daeed75

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\Readme_Instructions.html
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  9ae54b4efc9f30245782c6001f69b120

                                                  SHA1

                                                  3de64c5e9732699b76510728e43f408c131a995e

                                                  SHA256

                                                  cef2395cc2ae718f07b84bdbae435752c0e7049aa6de8488ab045c07f5fd0b37

                                                  SHA512

                                                  fbbb0e2bf0d11756dba1d9bf0183a2f0ec94ee729d97740ed3ba47b3f99922188fc04fdbc255f51a3544fa3bfc7ed588d3aabb45de0ed59ed96ce6d15daeed75

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Readme_Instructions.html
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  9ae54b4efc9f30245782c6001f69b120

                                                  SHA1

                                                  3de64c5e9732699b76510728e43f408c131a995e

                                                  SHA256

                                                  cef2395cc2ae718f07b84bdbae435752c0e7049aa6de8488ab045c07f5fd0b37

                                                  SHA512

                                                  fbbb0e2bf0d11756dba1d9bf0183a2f0ec94ee729d97740ed3ba47b3f99922188fc04fdbc255f51a3544fa3bfc7ed588d3aabb45de0ed59ed96ce6d15daeed75

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SIUOQIRU.txt
                                                  Filesize

                                                  605B

                                                  MD5

                                                  6bf004e6059732805c173ac9812e241d

                                                  SHA1

                                                  8fb7637f6be4ea9e98b291e811fcc34d4e2691ad

                                                  SHA256

                                                  be9296b5661d0bf7350192da137658202b92ad67fb37fdbf042c54f2a7c0de6a

                                                  SHA512

                                                  4e0093f83ce72f2bd0f879f44024fc48ec81d14f263eef1457b3570ce0e1b2261a5dd50ff7a30c272cc662083b4d344b40e1e2ec1f1276298a49df77d4969086

                                                  Download Submit
                                                • C:\Users\Admin\Desktop\Readme_Instructions.html
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  9ae54b4efc9f30245782c6001f69b120

                                                  SHA1

                                                  3de64c5e9732699b76510728e43f408c131a995e

                                                  SHA256

                                                  cef2395cc2ae718f07b84bdbae435752c0e7049aa6de8488ab045c07f5fd0b37

                                                  SHA512

                                                  fbbb0e2bf0d11756dba1d9bf0183a2f0ec94ee729d97740ed3ba47b3f99922188fc04fdbc255f51a3544fa3bfc7ed588d3aabb45de0ed59ed96ce6d15daeed75

                                                  Download Submit
                                                • memory/360-80-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/452-88-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/520-55-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/576-76-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/580-87-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/588-71-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/624-69-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/652-68-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/776-86-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/900-59-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/960-74-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/976-89-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1000-64-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1072-81-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1084-73-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1092-58-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1092-75-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1100-83-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1128-67-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1204-57-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1208-56-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1484-79-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1516-77-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1520-82-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1624-62-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1632-65-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1640-63-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1676-78-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1708-70-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1712-85-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1756-66-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1816-54-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1924-72-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1960-61-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1976-60-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/1988-84-0x0000000000000000-mapping.dmp
                                                  Download