Overview

overview

10

Static

static

3

WannaCrypt0r.zip

windows7-x64

1

Endermanch...0r.exe

windows7-x64

10

Analysis

  • max time kernel
    599s
  • max time network
    576s
  • platform
    windows7_x64
  • resource
    win7-20231215-es
  • resource tags

    arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    24/01/2024, 16:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    [email protected]
  • Size 3.4MB
  • Sample240124-tg8afadfd4
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
wannacrydiscoverypersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Sets desktop wallpaper using registry
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      2⤵
      • Views/modifies file attributes
      PID:2588
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:2160
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c 62911706112253.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\cscript.exe
        cscript.exe //nologo m.vbs
        3⤵
        • Loads dropped DLL
        PID:2792
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +s F:\$RECYCLE
      2⤵
      • Views/modifies file attributes
      PID:2092
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected] co
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1224
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Users\Admin\AppData\Local\Temp\@[email protected]
        @[email protected] vs
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin delete shadows /all /quiet
            5⤵
            • Interacts with shadow copies
            PID:1028
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1032
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2420
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1312
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      @[email protected]
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • Suspicious use of SetWindowsHookEx
      PID:2092
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "mouxeluelpibil036" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      2⤵
        PID:2052
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "mouxeluelpibil036" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
          3⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:1256
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1812
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:368
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2148
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2688
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2876
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2896
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2924
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1560
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2792
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:812
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2440
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1724
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1156
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1860
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:844
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2024
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:3016
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2784
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1824
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2340
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:2928
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:2592
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:1680
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:3028
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:1372
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1700
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:268
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:828
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:1052
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1816
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:1916
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:1264
      • C:\Users\Admin\AppData\Local\Temp\taskse.exe
        taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
        2⤵
        • Executes dropped EXE
        PID:748
      • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        taskdl.exe
        2⤵
        • Executes dropped EXE
        PID:980
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:292

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          00000000.res
          • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
          • Size 136B
          • SHA256 4df865f34aeb998499381ba25d80166de91dd15afb6a16fa8486de9c7c44cd2d
          • MD5 SHA1 SHA512
          Submit Download

          1.WNCRYT
          • Path C:\Users\Admin\AppData\Local\Temp\1.WNCRYT
          • Size 651KB
          • SHA256 e0009be26bfff718617d155c58a3ceed6314570eba54b4d0ae11912e61929fed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          10.WNCRYT
          • Path C:\Users\Admin\AppData\Local\Temp\10.WNCRYT
          • Size 1.6MB
          • SHA256 9d29a51bb9fd30d5a5b94e6f33d6eb150ef604d080d9cd5560950f0fd0dc51ae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          11.WNCRYT
          • Path C:\Users\Admin\AppData\Local\Temp\11.WNCRYT
          • Size 11KB
          • SHA256 69eaffb2fe240146b75cfc87972b6daf0fc3a9b71cf85b5ca8b1a84db0a77adf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          12.WNCRYT
          • Path C:\Users\Admin\AppData\Local\Temp\12.WNCRYT
          • Size 11KB
          • SHA256 73a17c67ac9eaa662b803079a12f83dd7afa62e48c0e33f700b8800c7e18cb70
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          13.WNCRYT
          • Path C:\Users\Admin\AppData\Local\Temp\13.WNCRYT
          • Size 4.6MB
          • SHA256 6cf1512c297b1702af6af8b46f4d240b9747da285215c39509175c13cfcd034f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          14.WNCRYT
          • Path C:\Users\Admin\AppData\Local\Temp\14.WNCRYT
          • Size 11KB
          • SHA256 4acbeab9bab8a1fcae1e50ba319a30f9e2ea2104c0864db6b33d315edf54d16c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          62911706112253.bat
          • Path C:\Users\Admin\AppData\Local\Temp\62911706112253.bat
          • Size 340B
          • SHA256 4e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f
          • MD5 SHA1 SHA512
          Submit Download

          @[email protected]
          • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
          • Size 240KB
          • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          @[email protected]
          • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
          • Size 920B
          • SHA256 069e3555582ab50cc3726c951099f1b90bbf0472effefc62a29383571e4746c9
          • MD5 SHA1 SHA512
          Submit Download

          LIBEAY32.dll
          • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\LIBEAY32.dll
          • Size 2.5MB
          • SHA256 51acc82c54d9b26deab30b51e8f9f642775fea89ed0aaac4e9a3873c4d43831e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SSLEAY32.dll
          • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\SSLEAY32.dll
          • Size 694KB
          • SHA256 bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          taskhsvc.exe
          • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
          • Size 1.7MB
          • SHA256 cf6041a612cd11000108b8f5d05077afa7faef2aaadb853f77c47daad84862fe
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          taskhsvc.exe
          • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
          • Size 1.5MB
          • SHA256 e2d1081e04292391ae27f00aff2dd8273a8c518973d72748757d91ee428dd544
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          b.wnry
          • Path C:\Users\Admin\AppData\Local\Temp\b.wnry
          • Size 1.4MB
          • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          c.wnry
          • Path C:\Users\Admin\AppData\Local\Temp\c.wnry
          • Size 780B
          • SHA256 079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
          • MD5 SHA1 SHA512
          Submit Download

          c.wnry
          • Path C:\Users\Admin\AppData\Local\Temp\c.wnry
          • Size 780B
          • SHA256 08667c7ff6ca67f9a544a6dc5694bec3871c20f620694dc202511a7652be620d
          • MD5 SHA1 SHA512
          Submit Download

          m.vbs
          • Path C:\Users\Admin\AppData\Local\Temp\m.vbs
          • Size 219B
          • SHA256 7fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa
          • MD5 SHA1 SHA512
          Submit Download

          m_Spanish.wnry
          • Path C:\Users\Admin\AppData\Local\Temp\msg\m_Spanish.wnry
          • Size 36KB
          • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          m_finnish.wnry
          • Path C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry
          • Size 37KB
          • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          s.wnry
          • Path C:\Users\Admin\AppData\Local\Temp\s.wnry
          • Size 2.9MB
          • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cached-microdescs.new
          • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
          • Size 21.1MB
          • SHA256 a6c95253ae2fcd6197ec762edd24b315468a8bdec2e7e05623e9b5c0635644ed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          @[email protected]
          • Path C:\Users\Admin\Documents\@[email protected]
          • Size 933B
          • SHA256 0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a
          • MD5 SHA1 SHA512
          Submit Download

          libeay32.dll
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll
          • Size 3.0MB
          • SHA256 58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libevent-2-0-5.dll
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll
          • Size 702KB
          • SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libgcc_s_sjlj-1.dll
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll
          • Size 510KB
          • SHA256 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssp-0.dll
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll
          • Size 90KB
          • SHA256 f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          taskhsvc.exe
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
          • Size 2.4MB
          • SHA256 ea390ca0b3ec46dee1e3b8366fcc34a694df41f71bc7dfee10a2427fea18710b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          taskhsvc.exe
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
          • Size 1.8MB
          • SHA256 45ba7db8f9249d2a58229e24a7574dbb672c400094eea6ec246edaac4f212a52
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zlib1.dll
          • Path \Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll
          • Size 105KB
          • SHA256 66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          taskdl.exe
          • Path \Users\Admin\AppData\Local\Temp\taskdl.exe
          • Size 20KB
          • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          taskse.exe
          • Path \Users\Admin\AppData\Local\Temp\taskse.exe
          • Size 20KB
          • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1224-783-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-788-0x0000000074910000-0x0000000074992000-memory.dmp
          Download

          memory/1224-789-0x00000000748E0000-0x0000000074902000-memory.dmp
          Download

          memory/1224-791-0x00000000749A0000-0x0000000074BBC000-memory.dmp
          Download

          memory/1224-792-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-787-0x00000000749A0000-0x0000000074BBC000-memory.dmp
          Download

          memory/1224-786-0x0000000074BC0000-0x0000000074C37000-memory.dmp
          Download

          memory/1224-785-0x00000000750C0000-0x00000000750DC000-memory.dmp
          Download

          memory/1224-823-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-824-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-828-0x00000000749A0000-0x0000000074BBC000-memory.dmp
          Download

          memory/1224-838-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-842-0x00000000749A0000-0x0000000074BBC000-memory.dmp
          Download

          memory/1224-784-0x0000000074C40000-0x0000000074CC2000-memory.dmp
          Download

          memory/1224-862-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-905-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-919-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-926-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-780-0x0000000000D00000-0x0000000000FFE000-memory.dmp
          Download

          memory/1224-778-0x00000000748E0000-0x0000000074902000-memory.dmp
          Download

          memory/1224-776-0x0000000074910000-0x0000000074992000-memory.dmp
          Download

          memory/1224-774-0x00000000749A0000-0x0000000074BBC000-memory.dmp
          Download

          memory/1224-772-0x0000000074C40000-0x0000000074CC2000-memory.dmp
          Download

          memory/2284-39-0x0000000010000000-0x0000000010010000-memory.dmp
          Download