Overview

overview

10

Static

static

3

VirusShare...d4.exe

windows7-x64

10

VirusShare...d4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 21:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_2868401dabd038143ca5442e05624bd4.exe
  • Size 344KB
  • Sample240610-1cs4aa1dkd
  • SHA256 38129f85a69aebacbd4a0667272b249e56b15eb9593fbeed2a4faa99851fdbd2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\how_recover+tew.txt

Ransom Note
  • 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/D84B1A247391993 2. http://vr6g2curb2kcidou.expay34.com/D84B1A247391993 3. http://psbc532jm8c.hsh73cu37n1.net/D84B1A247391993 4. https://vr6g2curb2kcidou.onion.to/D84B1A247391993 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/D84B1A247391993 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/D84B1A247391993 http://vr6g2curb2kcidou.expay34.com/D84B1A247391993 http://psbc532jm8c.hsh73cu37n1.net/D84B1A247391993 https://vr6g2curb2kcidou.onion.to/D84B1A247391993 Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/D84B1A247391993 Your personal identification number (if you open the site (or TOR-Browser's) directly): D84B1A247391993 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
URLs

  • http://vr6g2curb2kcidou.encpayment23.com/D84B1A247391993

  • http://vr6g2curb2kcidou.expay34.com/D84B1A247391993

  • http://psbc532jm8c.hsh73cu37n1.net/D84B1A247391993

  • https://vr6g2curb2kcidou.onion.to/D84B1A247391993

  • http://vr6g2curb2kcidou.onion/D84B1A247391993

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Renames multiple (880) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_2868401dabd038143ca5442e05624bd4.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Users\Admin\AppData\Roaming\aexhhacroic.exe
        C:\Users\Admin\AppData\Roaming\aexhhacroic.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Users\Admin\AppData\Roaming\aexhhacroic.exe
          C:\Users\Admin\AppData\Roaming\aexhhacroic.exe
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4360
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} bootems off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2876
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:1816
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} advancedoptions off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:4208
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} optionsedit off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:4168
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2860
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} recoveryenabled off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1596
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:3976
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:632
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff075446f8,0x7fff07544708,0x7fff07544718
              6⤵
                PID:548
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                6⤵
                  PID:4168
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                  6⤵
                    PID:1472
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
                    6⤵
                      PID:1476
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                      6⤵
                        PID:4324
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                        6⤵
                          PID:1504
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                          6⤵
                            PID:3520
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                            6⤵
                              PID:4836
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
                              6⤵
                                PID:3540
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                                6⤵
                                  PID:2300
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                                  6⤵
                                    PID:4912
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5996876988382901436,5041790524135710912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                    6⤵
                                      PID:4308
                                  • C:\Windows\System32\vssadmin.exe
                                    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
                                    5⤵
                                    • Interacts with shadow copies
                                    PID:1524
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\AEXHHA~1.EXE
                                    5⤵
                                      PID:1348
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
                                  3⤵
                                    PID:3044
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2552
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5036
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3960

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        how_recover+tew.html
                                        • Path C:\Program Files\7-Zip\Lang\how_recover+tew.html
                                        • Size 9KB
                                        • SHA256 5ab10be4f6677e2f35020c47d4579c5d112182ce2554214356fa19686b228736
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        how_recover+tew.txt
                                        • Path C:\Program Files\7-Zip\Lang\how_recover+tew.txt
                                        • Size 2KB
                                        • SHA256 ee7dfaecde257ef73650a6b6e1e57e96a4a10e4dae5b47a578884cfd8a8917f9
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Size 606B
                                        • SHA256 140d38ecb061b053b226aff0cd8394aade7b30f80d664890d3329a3bdbc8f97f
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                        • Size 606B
                                        • SHA256 ba95895bb242de5675dd24cd8b7f462e7b2b3ff6535c89ea7a3cf6c17d56f882
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        ClientSub2019_eula.txt
                                        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                        • Size 462B
                                        • SHA256 7004721994867deb26c0c9d3487411ef8c4d083c29127c6cc41c4921b6167ef1
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 5KB
                                        • SHA256 d795bb3c375553cdf25a25f16d933a37b412e066c81c229696ac3c4ff1a2ea23
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 6KB
                                        • SHA256 14e9a0d55913e1b6a6e539dd3cc48e3adb60372a7cc5c7ba35e179acc69efad0
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 10KB
                                        • SHA256 58cca0bb9bbe9ead4102011875ad8ce56dc0d134b8bc1fa525ce7311d787e69f
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        0.1.filtertrie.intermediate.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bdb6e241-6c31-4a4e-a79d-584ce69fab3b}\0.1.filtertrie.intermediate.txt
                                        • Size 430B
                                        • SHA256 406362797ce5b97d9a9921b484094c86d7b4a1b79d306b8b564fad292a009e85
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        0.2.filtertrie.intermediate.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bdb6e241-6c31-4a4e-a79d-584ce69fab3b}\0.2.filtertrie.intermediate.txt
                                        • Size 430B
                                        • SHA256 8f31c10c85b417319d9cef5f8e5c476f7e0a8beb94222cb9ed0d3cc714b40d8f
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        AppCache133586097090598174.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586097090598174.txt
                                        • Size 75KB
                                        • SHA256 b62e906a2a945169d4868cbd405b41b7ef8e8d6d25521b03daeaae6d7850e848
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        aexhhacroic.exe
                                        • Path C:\Users\Admin\AppData\Roaming\aexhhacroic.exe
                                        • Size 344KB
                                        • SHA256 38129f85a69aebacbd4a0667272b249e56b15eb9593fbeed2a4faa99851fdbd2
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        memory/228-3-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/228-4-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/228-1-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/228-10-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/228-2-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/1272-12-0x0000000000400000-0x00000000005CB000-memory.dmp
                                        Download

                                        memory/4008-5-0x0000000000730000-0x0000000000733000-memory.dmp
                                        Download

                                        memory/4008-0-0x0000000000730000-0x0000000000733000-memory.dmp
                                        Download

                                        memory/4360-15-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-7541-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-7542-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-7551-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-5716-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-7557-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-1041-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-864-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-21-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-7593-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-22-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-18-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-16-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/4360-17-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download