Overview

overview

10

Static

static

3

VirusShare...24.exe

windows7-x64

10

VirusShare...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_1d2cca249c4ad2723ffe6623e4780c24.exe
  • Size 368KB
  • Sample240610-msptxagg23
  • SHA256 5b2bf628d09ba68874c73b447b19849ab3e182aa8983a37dac7561960e33c85d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\Recovery+yfnny.txt

Ransom Note
  • __!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C0347141B96129A1 2. http://b4youfred5485jgsa3453f.italazudda.com/C0347141B96129A1 3. http://5rport45vcdef345adfkksawe.bematvocal.at/C0347141B96129A1 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/C0347141B96129A1 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C0347141B96129A1 http://b4youfred5485jgsa3453f.italazudda.com/C0347141B96129A1 http://5rport45vcdef345adfkksawe.bematvocal.at/C0347141B96129A1 *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/C0347141B96129A1 *-*-* Your personal identification ID: C0347141B96129A1
URLs

  • http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C0347141B96129A1

  • http://b4youfred5485jgsa3453f.italazudda.com/C0347141B96129A1

  • http://5rport45vcdef345adfkksawe.bematvocal.at/C0347141B96129A1

  • http://fwgrhsao3aoml7ej.onion/C0347141B96129A1

  • http://fwgrhsao3aoml7ej.ONION/C0347141B96129A1

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (884) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_1d2cca249c4ad2723ffe6623e4780c24.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_1d2cca249c4ad2723ffe6623e4780c24.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_1d2cca249c4ad2723ffe6623e4780c24.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_1d2cca249c4ad2723ffe6623e4780c24.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\Windows\fnjcskddbpyp.exe
        C:\Windows\fnjcskddbpyp.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\fnjcskddbpyp.exe
          C:\Windows\fnjcskddbpyp.exe
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:564
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4568
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:400
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5b7c46f8,0x7ffa5b7c4708,0x7ffa5b7c4718
              6⤵
                PID:2280
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                6⤵
                  PID:696
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                  6⤵
                    PID:4528
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
                    6⤵
                      PID:5008
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                      6⤵
                        PID:4900
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                        6⤵
                          PID:3880
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
                          6⤵
                            PID:3876
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
                            6⤵
                              PID:1004
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                              6⤵
                                PID:4956
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                                6⤵
                                  PID:1752
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                                  6⤵
                                    PID:5020
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18146278893542668543,4832759937327987108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                    6⤵
                                      PID:792
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\FNJCSK~1.EXE
                                    5⤵
                                      PID:4400
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
                                  3⤵
                                    PID:1256
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:440
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2216
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4808

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        Recovery+yfnny.html
                                        • Path C:\Program Files\7-Zip\Lang\Recovery+yfnny.html
                                        • Size 8KB
                                        • SHA256 bbdfc355fa6f826662a9fe745519d3f71d598f41f1001f0e43b488dd26fcab59
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Recovery+yfnny.png
                                        • Path C:\Program Files\7-Zip\Lang\Recovery+yfnny.png
                                        • Size 68KB
                                        • SHA256 26506c7f9604633eb0668d03e0bd9a7df652c06ddc43549b66d4175f03236eec
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Recovery+yfnny.txt
                                        • Path C:\Program Files\7-Zip\Lang\Recovery+yfnny.txt
                                        • Size 2KB
                                        • SHA256 920700f05cc8e34be809f4d9946488432047e7407ed57b29fe61c4b127bfda91
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Size 560B
                                        • SHA256 7591d069425598895d4b2151d9070b7c8595785871c92e1e2c2286e3cc41e8ff
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                        • Size 560B
                                        • SHA256 91ffcab40a406a1ff582f0638d29bac63d12a42893f827ea338de4598193ba9d
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        ClientSub2019_eula.txt
                                        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                        • Size 416B
                                        • SHA256 d32edbb4397db9be5312382049e92ffbf5ac3385309cbf2f63f57b521d8e661a
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 5KB
                                        • SHA256 2a338288e7fb0603e5d813a55d89d949a8ba381e7148c4ba41635672d1e7dee7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 6KB
                                        • SHA256 52e23487f5a3c63654fa93c1cb7d79aa1242d25caa51bc499a7f524584dd28f6
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 10KB
                                        • SHA256 100f8d22b6d660fc617b59e116bd15b8da30335bff0299c85c35c9fe6aab6579
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        AppCache133596440659070499.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440659070499.txt
                                        • Size 47KB
                                        • SHA256 36bbd962ec9bf16eb81cb793f3a0110a3630a77231835418baca8e754ca4a1b5
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        AppCache133596449628541770.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596449628541770.txt
                                        • Size 75KB
                                        • SHA256 d73a816a5ae16265632b9d2c0772359f9bada90279131170eb9690df00b01645
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        fnjcskddbpyp.exe
                                        • Path C:\Windows\fnjcskddbpyp.exe
                                        • Size 368KB
                                        • SHA256 5b2bf628d09ba68874c73b447b19849ab3e182aa8983a37dac7561960e33c85d
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        memory/564-17-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-8547-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-25-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-24-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-21-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-20-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-18-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-2733-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-5246-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-10420-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-10381-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-57-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-10373-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/564-10374-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/1580-0-0x0000000000B80000-0x0000000000B83000-memory.dmp
                                        Download

                                        memory/1580-5-0x0000000000B80000-0x0000000000B83000-memory.dmp
                                        Download

                                        memory/1580-1-0x0000000000B80000-0x0000000000B83000-memory.dmp
                                        Download

                                        memory/3604-12-0x0000000000400000-0x0000000000597000-memory.dmp
                                        Download

                                        memory/3604-19-0x0000000000400000-0x0000000000597000-memory.dmp
                                        Download

                                        memory/3736-13-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/3736-6-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/3736-4-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/3736-3-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download

                                        memory/3736-2-0x0000000000400000-0x0000000000485000-memory.dmp
                                        Download