Overview

overview

10

Static

static

3

a7c903bb30...55.exe

windows7-x64

10

a7c903bb30...55.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2024, 00:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a7c903bb30f41066a670c09194a07955.exe
  • Size 3.3MB
  • Sample240227-a4cbqscc95
  • SHA256 321ad36cf8f20be8c53d060b3043706a58ba49c4c25c994c96d19932137838cb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
nullmixerredlinesectopratsmokeloadervidar706anioldpub5aspackv2backdoordropperinfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • nullmixer

C2

  • http://watira.xyz/

Extracted

Family

  • smokeloader

Botnet

  • pub5

Extracted

Family

  • vidar

Version

  • 39.8

Botnet

  • 706

C2

  • https://xeronxikxxx.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

  • redline

Botnet

  • AniOLD

C2

  • liezaphare.xyz:80

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://aucmoney.com/upload/

  • http://thegymmum.com/upload/

  • http://atvcampingtrips.com/upload/

  • http://kuapakualaman.com/upload/

  • http://renatazarazua.com/upload/

  • http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar Stealer 3 IoCs
    stealer
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 28 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7c903bb30f41066a670c09194a07955.exe
    "C:\Users\Admin\AppData\Local\Temp\a7c903bb30f41066a670c09194a07955.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sonia_1.exe
          4⤵
            PID:2852
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_1.exe
              sonia_1.exe
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:5076
              • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_1.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_1.exe" -a
                6⤵
                • Executes dropped EXE
                PID:3112
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_2.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4148
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_2.exe
              sonia_2.exe
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:552
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 372
                6⤵
                • Program crash
                PID:3624
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_3.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1356
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_3.exe
              sonia_3.exe
              5⤵
              • Executes dropped EXE
              PID:4840
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 1028
                6⤵
                • Program crash
                • Suspicious use of WriteProcessMemory
                PID:2852
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_4.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2920
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_4.exe
              sonia_4.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:5080
              • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_4.exe
                C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_4.exe
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4540
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_5.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3688
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_5.exe
              sonia_5.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Users\Admin\AppData\Local\Temp\is-4UAPP.tmp\sonia_5.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-4UAPP.tmp\sonia_5.tmp" /SL5="$60182,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_5.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3952
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_6.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3328
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_6.exe
              sonia_6.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3528
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_7.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_7.exe
              sonia_7.exe
              5⤵
              • Executes dropped EXE
              PID:4452
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_8.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3300
            • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_8.exe
              sonia_8.exe
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:2496
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf
                6⤵
                  PID:1232
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd
                    7⤵
                      PID:2468
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf
                        8⤵
                          PID:3180
                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                          Triste.exe.com n
                          8⤵
                          • Executes dropped EXE
                          PID:1132
                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n
                            9⤵
                            • Executes dropped EXE
                            PID:1772
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 30
                          8⤵
                          • Runs ping.exe
                          PID:4372
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sonia_9.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3404
                  • C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_9.exe
                    sonia_9.exe
                    5⤵
                    • Executes dropped EXE
                    PID:2864
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 576
                  4⤵
                  • Program crash
                  PID:1904
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1756 -ip 1756
            1⤵
              PID:5044
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4840 -ip 4840
              1⤵
                PID:2400
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 552 -ip 552
                1⤵
                  PID:2928
                • C:\Windows\system32\sihost.exe
                  sihost.exe
                  1⤵
                  • Suspicious use of FindShellTrayWindow
                  PID:1116
                  • C:\Windows\explorer.exe
                    explorer.exe /LOADSAVEDWINDOWS
                    2⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:1560
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2928
                • C:\Windows\system32\dwm.exe
                  "dwm.exe"
                  1⤵
                  • Checks SCSI registry key(s)
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  PID:3524
                • C:\Windows\system32\dwm.exe
                  "dwm.exe"
                  1⤵
                    PID:2220

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        IconCache.db
                        • Path C:\Users\Admin\AppData\Local\IconCache.db
                        • Size 14KB
                        • SHA256 235b155473539649ef06f29bc2327c0cd75a34a8460ee150cfa1d71d31cefc42
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_4.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sonia_4.exe.log
                        • Size 700B
                        • SHA256 b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
                        • MD5 SHA1 SHA512
                        Submit Download

                        DiscoverCacheData.dat
                        • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                        • Size 1022B
                        • SHA256 390f96b667138f3bbdf86328c251cc62278e02b4b9b1b75aa52cfe41aa6c2ade
                        • MD5 SHA1 SHA512
                        Submit Download

                        Compatto.rtf
                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Compatto.rtf
                        • Size 478B
                        • SHA256 2c1458ecd2cc31a6d798a1c6396926cb99a66481832f774dbdbc19594ff9bd40
                        • MD5 SHA1 SHA512
                        Submit Download

                        Incontrati.rtf
                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Incontrati.rtf
                        • Size 7KB
                        • SHA256 8dec7534543bc983bcd6965539e3d26de768775ac117a108b545a5b4e3bb3614
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Oggi.rtf
                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Oggi.rtf
                        • Size 872KB
                        • SHA256 d574f83fc092c037db7625e3b2dbe16a4898f9e8ec187c3a5744c699bdb5b75e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Triste.exe.com
                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                        • Size 872KB
                        • SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Troverai.rtf
                        • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Troverai.rtf
                        • Size 703KB
                        • SHA256 94b01919c10661d96e0f8ccf05e143b76d94cae3dafc0e5cc7998d22b060ad1a
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        libcurl.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\libcurl.dll
                        • Size 218KB
                        • SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        libcurlpp.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\libcurlpp.dll
                        • Size 54KB
                        • SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        libgcc_s_dw2-1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\libgcc_s_dw2-1.dll
                        • Size 113KB
                        • SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        libstdc++-6.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\libstdc++-6.dll
                        • Size 647KB
                        • SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        libwinpthread-1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\libwinpthread-1.dll
                        • Size 69KB
                        • SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        setup_install.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\setup_install.exe
                        • Size 290KB
                        • SHA256 0d9c80822deba3b906e38e1ee5bf5208e518d35a96d46f06daa590285109f68b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_1.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_1.txt
                        • Size 56KB
                        • SHA256 78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_2.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_2.txt
                        • Size 259KB
                        • SHA256 0c7db57068a7a3800d0a07927f6fb9920c02420a4952a858c175ce48075327d0
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_3.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_3.txt
                        • Size 597KB
                        • SHA256 82ff83ce0665382ce20ccb6a1295bce8eff4653edadb331814c43ef198265a27
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_4.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_4.txt
                        • Size 390KB
                        • SHA256 da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_5.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_5.exe
                        • Size 320KB
                        • SHA256 707051eece470cb1e39ce4fcfa5623cbcf8f8a7c38439fa06bb125ac8c600e7d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_5.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_5.txt
                        • Size 749KB
                        • SHA256 bb271be24f3e60b032f3269aa7b6fe62b8d0c2c2a3ffd57febae6b11c0a8a1fa
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_6.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_6.txt
                        • Size 170KB
                        • SHA256 6c7d057e00b8ecac9ec9c1bf9ec9584c43f0767d0172d66ad726652268209ff2
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_7.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_7.txt
                        • Size 1.1MB
                        • SHA256 71f5bb7d9ace05cfb89e95843499c1c19ca1d6c8b1cd66561d24ceb9ffa94862
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_8.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_8.txt
                        • Size 882KB
                        • SHA256 4363307739b80f6e418170a049b1a4c52e0405161f18588a8330a849ac4a9a62
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_9.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\7zS0DDC7677\sonia_9.txt
                        • Size 252KB
                        • SHA256 2e11c0fee3c9df36052fd654193e6f5f935d66619c12e5b7ffabf926c20f3389
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        idp.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\is-118H0.tmp\idp.dll
                        • Size 216KB
                        • SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        sonia_5.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\is-4UAPP.tmp\sonia_5.tmp
                        • Size 1.0MB
                        • SHA256 5f77587b1ad42e5e9a979a9f956e56db5e61c54ea8a3afe4d0dac9a51e0ee162
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        setup_installer.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                        • Size 192KB
                        • SHA256 3596f041d40fc7bb703113a320677d773b49bf84f4da654a0250956dcf751327
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        setup_installer.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                        • Size 2.9MB
                        • SHA256 f604b064b634ae99223b0d53124d36651444a6e5f451a06540f87b838be4532f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        setup_installer.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                        • Size 704KB
                        • SHA256 c35c04fc994ef48d049a5cff1f46225f8b0418a1cd009e3d782862e2938051e2
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        memory/552-146-0x0000000000400000-0x00000000004C5000-memory.dmp
                        Download

                        memory/552-141-0x0000000000510000-0x0000000000519000-memory.dmp
                        Download

                        memory/552-139-0x00000000005E0000-0x00000000006E0000-memory.dmp
                        Download

                        memory/552-200-0x0000000000400000-0x00000000004C5000-memory.dmp
                        Download

                        memory/1756-76-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-142-0x000000006B440000-0x000000006B4CF000-memory.dmp
                        Download

                        memory/1756-78-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-75-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-77-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-48-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-61-0x000000006B440000-0x000000006B4CF000-memory.dmp
                        Download

                        memory/1756-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
                        Download

                        memory/1756-62-0x000000006B280000-0x000000006B2A6000-memory.dmp
                        Download

                        memory/1756-65-0x000000006B440000-0x000000006B4CF000-memory.dmp
                        Download

                        memory/1756-64-0x0000000000EE0000-0x0000000000F6F000-memory.dmp
                        Download

                        memory/1756-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                        Download

                        memory/1756-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                        Download

                        memory/1756-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                        Download

                        memory/1756-69-0x0000000064940000-0x0000000064959000-memory.dmp
                        Download

                        memory/1756-74-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-73-0x000000006B280000-0x000000006B2A6000-memory.dmp
                        Download

                        memory/1756-79-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                        Download

                        memory/1756-72-0x000000006B280000-0x000000006B2A6000-memory.dmp
                        Download

                        memory/1756-147-0x0000000000EE0000-0x0000000000F6F000-memory.dmp
                        Download

                        memory/1756-136-0x0000000000400000-0x000000000051D000-memory.dmp
                        Download

                        memory/1756-137-0x000000006B280000-0x000000006B2A6000-memory.dmp
                        Download

                        memory/1756-138-0x000000006EB40000-0x000000006EB63000-memory.dmp
                        Download

                        memory/1756-140-0x0000000064940000-0x0000000064959000-memory.dmp
                        Download

                        memory/1756-144-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                        Download

                        memory/1804-92-0x0000000000400000-0x000000000046D000-memory.dmp
                        Download

                        memory/1804-174-0x0000000000400000-0x000000000046D000-memory.dmp
                        Download

                        memory/1804-194-0x0000000000400000-0x000000000046D000-memory.dmp
                        Download

                        memory/2928-213-0x0000000003FB0000-0x0000000003FB1000-memory.dmp
                        Download

                        memory/3452-197-0x0000000003080000-0x0000000003096000-memory.dmp
                        Download

                        memory/3452-207-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
                        Download

                        memory/3528-133-0x000000001B290000-0x000000001B2A0000-memory.dmp
                        Download

                        memory/3528-121-0x0000000000C30000-0x0000000000C56000-memory.dmp
                        Download

                        memory/3528-120-0x00007FF942F60000-0x00007FF943A21000-memory.dmp
                        Download

                        memory/3528-132-0x0000000000C50000-0x0000000000C56000-memory.dmp
                        Download

                        memory/3528-163-0x00007FF942F60000-0x00007FF943A21000-memory.dmp
                        Download

                        memory/3528-109-0x0000000000C20000-0x0000000000C26000-memory.dmp
                        Download

                        memory/3528-104-0x0000000000450000-0x0000000000484000-memory.dmp
                        Download

                        memory/3952-186-0x0000000000400000-0x0000000000516000-memory.dmp
                        Download

                        memory/3952-127-0x0000000002020000-0x0000000002021000-memory.dmp
                        Download

                        memory/4540-164-0x0000000000400000-0x000000000041E000-memory.dmp
                        Download

                        memory/4540-204-0x00000000056F0000-0x0000000005700000-memory.dmp
                        Download

                        memory/4540-169-0x0000000073350000-0x0000000073B00000-memory.dmp
                        Download

                        memory/4540-170-0x0000000005AE0000-0x00000000060F8000-memory.dmp
                        Download

                        memory/4540-171-0x00000000054F0000-0x0000000005502000-memory.dmp
                        Download

                        memory/4540-172-0x0000000005550000-0x000000000558C000-memory.dmp
                        Download

                        memory/4540-173-0x0000000005590000-0x00000000055DC000-memory.dmp
                        Download

                        memory/4540-195-0x0000000005810000-0x000000000591A000-memory.dmp
                        Download

                        memory/4540-178-0x00000000056F0000-0x0000000005700000-memory.dmp
                        Download

                        memory/4840-145-0x00000000021B0000-0x000000000224D000-memory.dmp
                        Download

                        memory/4840-196-0x0000000000400000-0x000000000051A000-memory.dmp
                        Download

                        memory/4840-149-0x0000000000400000-0x000000000051A000-memory.dmp
                        Download

                        memory/4840-148-0x0000000000780000-0x0000000000880000-memory.dmp
                        Download

                        memory/5080-122-0x0000000005090000-0x00000000050A0000-memory.dmp
                        Download

                        memory/5080-111-0x0000000004F30000-0x0000000004F4E000-memory.dmp
                        Download

                        memory/5080-101-0x0000000073350000-0x0000000073B00000-memory.dmp
                        Download

                        memory/5080-102-0x0000000004F70000-0x0000000004FE6000-memory.dmp
                        Download

                        memory/5080-168-0x0000000073350000-0x0000000073B00000-memory.dmp
                        Download

                        memory/5080-95-0x00000000006F0000-0x0000000000758000-memory.dmp
                        Download

                        memory/5080-134-0x0000000005670000-0x0000000005C14000-memory.dmp
                        Download