Overview

overview

10

Static

static

3

VirusShare...64.exe

windows7-x64

10

VirusShare...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 10:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_2bfb0ef1b81124ca61c93c341a9ed164.exe
  • Size 616KB
  • Sample240610-mwt8ssgg85
  • SHA256 86e08c4190074fa5774eb0f37afacf780bfe1b4f1335cccfcd1d5fe140e09b5b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\Recovery+qtlts.txt

Ransom Note
  • __!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://p57gest54celltraf743knjf.mottesapo.com/5CB867221FE24DB3 2. http://k4restportgonst34d23r.oftpony.at/5CB867221FE24DB3 3. http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/5CB867221FE24DB3 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/5CB867221FE24DB3 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *** Your personal pages: http://p57gest54celltraf743knjf.mottesapo.com/5CB867221FE24DB3 http://k4restportgonst34d23r.oftpony.at/5CB867221FE24DB3 http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/5CB867221FE24DB3 *** Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/5CB867221FE24DB3 *** Your personal identification ID: 5CB867221FE24DB3
URLs

  • http://p57gest54celltraf743knjf.mottesapo.com/5CB867221FE24DB3

  • http://k4restportgonst34d23r.oftpony.at/5CB867221FE24DB3

  • http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/5CB867221FE24DB3

  • http://fwgrhsao3aoml7ej.onion/5CB867221FE24DB3

  • http://fwgrhsao3aoml7ej.ONION/5CB867221FE24DB3

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (855) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_2bfb0ef1b81124ca61c93c341a9ed164.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_2bfb0ef1b81124ca61c93c341a9ed164.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_2bfb0ef1b81124ca61c93c341a9ed164.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_2bfb0ef1b81124ca61c93c341a9ed164.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Windows\mxrmwubydnxm.exe
        C:\Windows\mxrmwubydnxm.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\mxrmwubydnxm.exe
          C:\Windows\mxrmwubydnxm.exe
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1360
          • C:\Users\Admin\Documents\drmye.exe
            C:\Users\Admin\Documents\drmye.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4620
            • C:\Windows\System32\vssadmin.exe
              "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
              6⤵
              • Interacts with shadow copies
              PID:4000
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:5000
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:440
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcda1246f8,0x7ffcda124708,0x7ffcda124718
              6⤵
                PID:4680
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                6⤵
                  PID:3680
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                  6⤵
                    PID:4692
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
                    6⤵
                      PID:3552
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                      6⤵
                        PID:1336
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                        6⤵
                          PID:2748
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                          6⤵
                            PID:4684
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                            6⤵
                              PID:1576
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                              6⤵
                                PID:2820
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
                                6⤵
                                  PID:5048
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
                                  6⤵
                                    PID:2236
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7926118586377406216,8844023081651636466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                                    6⤵
                                      PID:3828
                                  • C:\Users\Admin\Documents\wslll.exe
                                    C:\Users\Admin\Documents\wslll.exe
                                    5⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:220
                                    • C:\Windows\System32\vssadmin.exe
                                      "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
                                      6⤵
                                      • Interacts with shadow copies
                                      PID:2348
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\MXRMWU~1.EXE
                                    5⤵
                                      PID:700
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
                                  3⤵
                                    PID:2792
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5020
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3948
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3916

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        Recovery+qtlts.html
                                        • Path C:\Program Files\7-Zip\Lang\Recovery+qtlts.html
                                        • Size 8KB
                                        • SHA256 4ae8c3e15fd13afa38fd6e0be980b35b6b3413b673bee74f1bec442be6f929ee
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Recovery+qtlts.png
                                        • Path C:\Program Files\7-Zip\Lang\Recovery+qtlts.png
                                        • Size 67KB
                                        • SHA256 914254063b6c73c8d3223a48bcb8cc7b886a04332a395489c931fc9f204b5803
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Recovery+qtlts.txt
                                        • Path C:\Program Files\7-Zip\Lang\Recovery+qtlts.txt
                                        • Size 2KB
                                        • SHA256 806b3fee22863278fc1e0a81b2671fe5280634d4653e5517143ec78bbb76a174
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Size 560B
                                        • SHA256 d9bc7b9afe92742686cbc136646d5fd84a8782a8dc79ea6fda07b91adfade2f3
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                        • Size 560B
                                        • SHA256 51921519ef61a615cc2a9fb91be970fdb3409bdd9f4cd32b6b81f98b672afd62
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        ClientSub2019_eula.txt
                                        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                        • Size 416B
                                        • SHA256 5dd27bc06f46466a7836234a6fe7516e628bbd8af540faaa6cfebf77a49cb51c
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 5KB
                                        • SHA256 710bb3e2d9be514b377268ad2a5837392b3c285fbf88d521213c2978ed37ecd1
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 6KB
                                        • SHA256 7cb8f8aedb9fc5ff301949629c2d4f338370a7b4a60f56c4020c78116c770693
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 10KB
                                        • SHA256 08635b028999a27af634c5f768a8d1655e169271662bb229c3b0456b64a759c9
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        AppCache133586114217182871.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586114217182871.txt
                                        • Size 75KB
                                        • SHA256 d40339dd1b87f7b0597d51940105b2ca23019c60e3dbd12259e42c5d3670b727
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        drmye.exe
                                        • Path C:\Users\Admin\Documents\drmye.exe
                                        • Size 5KB
                                        • SHA256 5119839eaaf7dfc670c7d2c8a83e74f895e07fab5f22c379185769eed07ece25
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        mxrmwubydnxm.exe
                                        • Path C:\Windows\mxrmwubydnxm.exe
                                        • Size 616KB
                                        • SHA256 86e08c4190074fa5774eb0f37afacf780bfe1b4f1335cccfcd1d5fe140e09b5b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        memory/1360-8896-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-17-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-26-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-18-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-273-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-20-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-10364-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-10415-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-2656-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-5401-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-10417-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-29-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/1360-10363-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/3056-19-0x0000000000400000-0x000000000078D000-memory.dmp
                                        Download

                                        memory/3056-12-0x0000000000400000-0x000000000078D000-memory.dmp
                                        Download

                                        memory/3952-0-0x0000000000DD0000-0x0000000000DD3000-memory.dmp
                                        Download

                                        memory/3952-4-0x0000000000DD0000-0x0000000000DD3000-memory.dmp
                                        Download

                                        memory/3952-1-0x0000000000DD0000-0x0000000000DD3000-memory.dmp
                                        Download

                                        memory/4088-5-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/4088-6-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/4088-13-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/4088-2-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download

                                        memory/4088-3-0x0000000000400000-0x0000000000487000-memory.dmp
                                        Download