Overview

overview

10

Static

static

3

a831e658b5...bb.exe

windows7-x64

10

a831e658b5...bb.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/02/2024, 04:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a831e658b5144fce65d5792fec93c5bb.exe
  • Size 3.6MB
  • Sample240227-evcclage3s
  • SHA256 9e74b137b73150bea9b3ef6b987d3af1b3c445163c8ea469e6608d3ebc6062d9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
fabookienullmixerredlinesectopratsmokeloadersocelarsvidar706anioldpub5aspackv2backdoordiscoverydropperinfostealerratspywarestealertrojanupx

Malware Config

Extracted

Family

  • nullmixer

C2

  • http://watira.xyz/

Extracted

Family

  • smokeloader

Botnet

  • pub5

Extracted

Family

  • vidar

Version

  • 39.9

Botnet

  • 706

C2

  • https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://aucmoney.com/upload/

  • http://thegymmum.com/upload/

  • http://atvcampingtrips.com/upload/

  • http://kuapakualaman.com/upload/

  • http://renatazarazua.com/upload/

  • http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • redline

Botnet

  • AniOLD

C2

  • liezaphare.xyz:80

Signatures

  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars payload 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Nirsoft 8 IoCs
  • Vidar Stealer 3 IoCs
    stealer
  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a831e658b5144fce65d5792fec93c5bb.exe
    "C:\Users\Admin\AppData\Local\Temp\a831e658b5144fce65d5792fec93c5bb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC4571546\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_1.exe
          4⤵
          • Loads dropped DLL
          PID:2252
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_1.exe
            sahiba_1.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_2.exe
          4⤵
          • Loads dropped DLL
          PID:528
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_2.exe
            sahiba_2.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:1676
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_3.exe
          4⤵
          • Loads dropped DLL
          PID:580
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_3.exe
            sahiba_3.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1568
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_4.exe
          4⤵
          • Loads dropped DLL
          PID:596
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_4.exe
            sahiba_4.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            PID:1348
            • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_4.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_4.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2468
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_5.exe
          4⤵
          • Loads dropped DLL
          PID:696
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_5.exe
            sahiba_5.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2396
            • C:\Users\Admin\AppData\Local\Temp\is-NBNV5.tmp\sahiba_5.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-NBNV5.tmp\sahiba_5.tmp" /SL5="$6011E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_5.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2288
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_6.exe
          4⤵
          • Loads dropped DLL
          PID:476
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_6.exe
            sahiba_6.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2600
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_7.exe
          4⤵
          • Loads dropped DLL
          PID:2732
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_7.exe
            sahiba_7.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            PID:1624
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sahiba_8.exe
          4⤵
          • Loads dropped DLL
          PID:1068
          • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_8.exe
            sahiba_8.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:1312
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              6⤵
                PID:2624
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im chrome.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2104
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sahiba_10.exe
            4⤵
            • Loads dropped DLL
            PID:1276
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sahiba_9.exe
            4⤵
            • Loads dropped DLL
            PID:996
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 436
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:1904
    • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_1.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_1.exe" -a
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2700
    • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_9.exe
      sahiba_9.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1792
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1864
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2268
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        2⤵
        • Executes dropped EXE
        PID:1668
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        2⤵
        • Executes dropped EXE
        PID:440
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        2⤵
        • Executes dropped EXE
        PID:2000
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        2⤵
        • Executes dropped EXE
        PID:2116
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        2⤵
        • Executes dropped EXE
        PID:2460
      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        2⤵
        • Executes dropped EXE
        PID:1936
    • C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_10.exe
      sahiba_10.exe
      1⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:1964

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          libcurlpp.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\libcurlpp.dll
          • Size 54KB
          • SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libgcc_s_dw2-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\libgcc_s_dw2-1.dll
          • Size 113KB
          • SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libstdc++-6.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\libstdc++-6.dll
          • Size 647KB
          • SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwinpthread-1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\libwinpthread-1.dll
          • Size 69KB
          • SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_1.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_1.txt
          • Size 56KB
          • SHA256 78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_10.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_10.txt
          • Size 8KB
          • SHA256 d63dc91ba0dfae41a1ede646ec00179ab4bff585d6265af09e8fbc0e5f105eff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_2.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_2.txt
          • Size 176KB
          • SHA256 de829982c02fc418e24b6cd38c67ad2bf6a5d63e8042635989be216383b36e7c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_3.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_3.txt
          • Size 543KB
          • SHA256 ed3f7046fcb7404a8a6f55bee1007ca87850a670db0280c7aff243f2e9b966dc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_4.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_4.txt
          • Size 397KB
          • SHA256 2de39e9f3bfd136cc29081be63528f89711cf820fae735f23412fe75c679d891
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_5.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_5.txt
          • Size 749KB
          • SHA256 c6b6d0aa7a9a46c81db2d12733268741ef78a667381b11eeafaa7e2a29c48c10
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_6.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_6.exe
          • Size 181KB
          • SHA256 eeac0ab9230e5f2527a890141d63f32611233c1c38223c37b0a17a9be705f7ad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_6.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_6.txt
          • Size 128KB
          • SHA256 2ff77a8a5d1e363fd8ec43c303e65695faec13e1215b4873523bb4cbb97e55c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_7.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_7.txt
          • Size 128KB
          • SHA256 13625ac4f9fc9d7e57b0b03f8cc11fd3f2a36cc5024b95b07855f5df0a793d28
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_8.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_8.txt
          • Size 64KB
          • SHA256 08f871e377ca4a440cc186ffef87ca84ee0298788d63fece5611db77e2abb95e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_9.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_9.txt
          • Size 64KB
          • SHA256 c30dc4aaba4b4c3afa34f42eb535075519673dbefe3689d3b9f0ca0f20205da0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Cab8039.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Cab8039.tmp
          • Size 65KB
          • SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Tar809A.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Tar809A.tmp
          • Size 171KB
          • SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jfiag3g_gg.exe
          • Path C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
          • Size 184KB
          • SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcurl.dll
          • Path \Users\Admin\AppData\Local\Temp\7zSC4571546\libcurl.dll
          • Size 218KB
          • SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sahiba_9.exe
          • Path \Users\Admin\AppData\Local\Temp\7zSC4571546\sahiba_9.exe
          • Size 983KB
          • SHA256 7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          setup_install.exe
          • Path \Users\Admin\AppData\Local\Temp\7zSC4571546\setup_install.exe
          • Size 287KB
          • SHA256 02f308dffaa1e7900c7f097fb8488e31cc0c89c7cee2a708dee24355b3aa0e89
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          setup_installer.exe
          • Path \Users\Admin\AppData\Local\Temp\setup_installer.exe
          • Size 3.5MB
          • SHA256 3e97d28315379d7c9488de8fbe86d305dfa0e119892dab194940636b92053a53
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/440-407-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/1296-483-0x0000000002B70000-0x0000000002B86000-memory.dmp
          Download

          memory/1348-154-0x0000000000810000-0x000000000087A000-memory.dmp
          Download

          memory/1356-46-0x0000000002C70000-0x0000000002D8E000-memory.dmp
          Download

          memory/1356-54-0x0000000002C80000-0x0000000002D9E000-memory.dmp
          Download

          memory/1568-577-0x0000000000400000-0x0000000002CBF000-memory.dmp
          Download

          memory/1568-399-0x0000000002DE0000-0x0000000002EE0000-memory.dmp
          Download

          memory/1568-615-0x0000000002DE0000-0x0000000002EE0000-memory.dmp
          Download

          memory/1568-400-0x0000000000240000-0x00000000002DD000-memory.dmp
          Download

          memory/1568-416-0x0000000000400000-0x0000000002CBF000-memory.dmp
          Download

          memory/1668-406-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/1676-485-0x0000000000400000-0x0000000002C63000-memory.dmp
          Download

          memory/1676-273-0x0000000002CE0000-0x0000000002DE0000-memory.dmp
          Download

          memory/1676-391-0x0000000000400000-0x0000000002C63000-memory.dmp
          Download

          memory/1676-283-0x00000000002C0000-0x00000000002C9000-memory.dmp
          Download

          memory/1792-395-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-603-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-648-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-646-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-499-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-647-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-645-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-541-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-542-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-642-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-544-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-643-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-635-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-634-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-629-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-630-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-474-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-473-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-420-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-272-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-613-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-612-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-421-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-500-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-419-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-397-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-602-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-418-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1792-543-0x00000000003C0000-0x000000000041B000-memory.dmp
          Download

          memory/1864-145-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/1936-547-0x0000000000240000-0x000000000029B000-memory.dmp
          Download

          memory/1936-546-0x0000000000240000-0x000000000029B000-memory.dmp
          Download

          memory/1936-545-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/1964-614-0x000000001B040000-0x000000001B0C0000-memory.dmp
          Download

          memory/1964-136-0x00000000009B0000-0x00000000009B8000-memory.dmp
          Download

          memory/1964-398-0x000000001B040000-0x000000001B0C0000-memory.dmp
          Download

          memory/1964-578-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp
          Download

          memory/1964-240-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp
          Download

          memory/2000-478-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/2000-475-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/2116-479-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/2268-155-0x0000000000240000-0x000000000024D000-memory.dmp
          Download

          memory/2268-146-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/2288-380-0x0000000000400000-0x0000000000516000-memory.dmp
          Download

          memory/2396-256-0x0000000000400000-0x000000000046D000-memory.dmp
          Download

          memory/2396-132-0x0000000000400000-0x000000000046D000-memory.dmp
          Download

          memory/2396-392-0x0000000000400000-0x000000000046D000-memory.dmp
          Download

          memory/2460-537-0x0000000000400000-0x000000000045B000-memory.dmp
          Download

          memory/2468-576-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2468-572-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2468-566-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2468-568-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2468-562-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2468-570-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Download

          memory/2468-561-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2468-574-0x0000000000400000-0x000000000041E000-memory.dmp
          Download

          memory/2600-217-0x00000000009B0000-0x00000000009B6000-memory.dmp
          Download

          memory/2600-417-0x000000001A630000-0x000000001A6B0000-memory.dmp
          Download

          memory/2600-579-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp
          Download

          memory/2600-271-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp
          Download

          memory/2600-616-0x000000001A630000-0x000000001A6B0000-memory.dmp
          Download

          memory/2600-627-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp
          Download

          memory/2600-175-0x00000000003F0000-0x0000000000416000-memory.dmp
          Download

          memory/2600-163-0x00000000003D0000-0x00000000003D6000-memory.dmp
          Download

          memory/2600-135-0x0000000000E50000-0x0000000000E86000-memory.dmp
          Download

          memory/2652-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp
          Download

          memory/2652-484-0x0000000064940000-0x0000000064959000-memory.dmp
          Download

          memory/2652-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
          Download

          memory/2652-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp
          Download

          memory/2652-61-0x000000006B280000-0x000000006B2A6000-memory.dmp
          Download

          memory/2652-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
          Download

          memory/2652-76-0x000000006B440000-0x000000006B4CF000-memory.dmp
          Download

          memory/2652-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp
          Download

          memory/2652-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
          Download

          memory/2652-81-0x000000006B280000-0x000000006B2A6000-memory.dmp
          Download

          memory/2652-83-0x0000000000400000-0x000000000051E000-memory.dmp
          Download

          memory/2652-75-0x0000000064940000-0x0000000064959000-memory.dmp
          Download

          memory/2652-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
          Download

          memory/2652-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
          Download

          memory/2652-486-0x000000006B280000-0x000000006B2A6000-memory.dmp
          Download

          memory/2652-488-0x000000006B440000-0x000000006B4CF000-memory.dmp
          Download

          memory/2652-476-0x0000000000400000-0x000000000051E000-memory.dmp
          Download

          memory/2652-82-0x000000006B280000-0x000000006B2A6000-memory.dmp
          Download

          memory/2652-86-0x0000000000400000-0x000000000051E000-memory.dmp
          Download

          memory/2652-490-0x000000006EB40000-0x000000006EB63000-memory.dmp
          Download

          memory/2652-87-0x0000000000400000-0x000000000051E000-memory.dmp
          Download

          memory/2652-88-0x0000000000400000-0x000000000051E000-memory.dmp
          Download

          memory/2652-491-0x000000006FE40000-0x000000006FFC6000-memory.dmp
          Download

          memory/2652-89-0x0000000000400000-0x000000000051E000-memory.dmp
          Download

          memory/2652-85-0x0000000000400000-0x000000000051E000-memory.dmp
          Download