Overview

overview

10

Static

static

3

VirusShare...88.exe

windows7-x64

10

VirusShare...88.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 11:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_6f2b558e974817ff40006ddb7039c388.exe
  • Size 300KB
  • Sample240610-nrtbdahd3t
  • SHA256 ce68afd45e2b3448aee1d06ea8f46a5e6ca9d4d370be316e96fa720a9ab76ada
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\how_recover+tim.txt

Ransom Note
  • ________________________1234____________________________________- What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? ________________________1234____________________________________ Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. ________________________1234____________________________________ For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gfhshhf.home7dfg4.com/4FB5E29B87192DE6 2. http://td63hftt.buwve5ton2.com/4FB5E29B87192DE6 3. https://tw7kaqthui5ojcez.onion.to/4FB5E29B87192DE6 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: tw7kaqthui5ojcez.onion/4FB5E29B87192DE6 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://gfhshhf.home7dfg4.com/4FB5E29B87192DE6 http://td63hftt.buwve5ton2.com/4FB5E29B87192DE6 https://tw7kaqthui5ojcez.onion.to/4FB5E29B87192DE6 Your personal page (using TOR-Browser): tw7kaqthui5ojcez.onion/4FB5E29B87192DE6 Your personal identification number (if you open the site (or TOR-Browser's) directly): 4FB5E29B87192DE6
URLs

  • http://gfhshhf.home7dfg4.com/4FB5E29B87192DE6

  • http://td63hftt.buwve5ton2.com/4FB5E29B87192DE6

  • https://tw7kaqthui5ojcez.onion.to/4FB5E29B87192DE6

  • http://tw7kaqthui5ojcez.onion/4FB5E29B87192DE6

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Renames multiple (877) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_6f2b558e974817ff40006ddb7039c388.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_6f2b558e974817ff40006ddb7039c388.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_6f2b558e974817ff40006ddb7039c388.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_6f2b558e974817ff40006ddb7039c388.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Roaming\xcsjj-a.exe
        C:\Users\Admin\AppData\Roaming\xcsjj-a.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Users\Admin\AppData\Roaming\xcsjj-a.exe
          C:\Users\Admin\AppData\Roaming\xcsjj-a.exe
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2012
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} bootems off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:4604
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} advancedoptions off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:3148
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} optionsedit off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:3836
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1608
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} recoveryenabled off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:4624
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:3872
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:1468
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:5056
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcd9546f8,0x7ffbcd954708,0x7ffbcd954718
              6⤵
                PID:2548
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
                6⤵
                  PID:5000
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
                  6⤵
                    PID:1652
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
                    6⤵
                      PID:436
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
                      6⤵
                        PID:5040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                        6⤵
                          PID:2608
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:8
                          6⤵
                            PID:3920
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 /prefetch:8
                            6⤵
                              PID:2692
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                              6⤵
                                PID:1016
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                6⤵
                                  PID:2552
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                                  6⤵
                                    PID:4320
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,9506624865870871245,15969054719441309699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
                                    6⤵
                                      PID:4460
                                  • C:\Windows\System32\vssadmin.exe
                                    "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
                                    5⤵
                                    • Interacts with shadow copies
                                    PID:1780
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\xcsjj-a.exe
                                    5⤵
                                      PID:1412
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
                                  3⤵
                                    PID:3392
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4244
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4472
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3864

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        how_recover+tim.html
                                        • Path C:\Program Files\7-Zip\Lang\how_recover+tim.html
                                        • Size 6KB
                                        • SHA256 b6cf79a2cf17e70ca4242d65907fd04c998d4e02aabdca88d1977e559bdea648
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        how_recover+tim.txt
                                        • Path C:\Program Files\7-Zip\Lang\how_recover+tim.txt
                                        • Size 2KB
                                        • SHA256 17bc9ab3a76535cd52ea0feb451d1f664bf91b93e89fec5964dc675028616b59
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                        • Size 606B
                                        • SHA256 da8646abce5f5dbc6e03973421a7e576790f021bf72037befbca74298b14509d
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        THIRDPARTYLICENSEREADME.txt
                                        • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                        • Size 606B
                                        • SHA256 d84f26910e6d5c8a3b63a27b6dbb2f8e67c44a328fde7d061ad6fc42a17747e7
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        ClientSub2019_eula.txt
                                        • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                        • Size 462B
                                        • SHA256 623f06087fa6b36122264603737bb0ce080cb45b7bea762fd4bc220a558da82c
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                        • Size 152B
                                        • SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 5KB
                                        • SHA256 e6d0937bdccc267497770168dfaa8f4b049a91a5970fed34467cdbdecefbff74
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Preferences
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                        • Size 6KB
                                        • SHA256 b435153ea1a4e728624f2b7e9f7d227af2bee5d2b8091bc0e48d770fa15d9059
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        CURRENT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                        • Size 16B
                                        • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Local State
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                        • Size 10KB
                                        • SHA256 d93a290230ee108c3df2c2e63ce0725b96798ed67fae36a3bebebbce7522bd38
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        0.1.filtertrie.intermediate.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.1.filtertrie.intermediate.txt
                                        • Size 430B
                                        • SHA256 77830239d2f73863b97c65720478af12d998c0ccfd8982c743a347db19203b9a
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        0.2.filtertrie.intermediate.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d9947943-ab0e-43c0-9dab-04016bd7df1d}\0.2.filtertrie.intermediate.txt
                                        • Size 430B
                                        • SHA256 e8516385f5147c0eeee968a3eba6babc9f6feaeac40edda5b8434f36217581c6
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        AppCache133586097090598174.txt
                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586097090598174.txt
                                        • Size 75KB
                                        • SHA256 b3ed109bf87a6f414d254a42e4820b08b5c63627ac6a139be1cbcd63734a6f11
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        xcsjj-a.exe
                                        • Path C:\Users\Admin\AppData\Roaming\xcsjj-a.exe
                                        • Size 300KB
                                        • SHA256 ce68afd45e2b3448aee1d06ea8f46a5e6ca9d4d370be316e96fa720a9ab76ada
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        memory/1492-0-0x0000000000760000-0x0000000000763000-memory.dmp
                                        Download

                                        memory/1492-3-0x0000000000760000-0x0000000000763000-memory.dmp
                                        Download

                                        memory/2012-20-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-23-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-15-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-16-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-4453-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-799-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-337-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-7574-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-7525-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-7526-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-7535-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-17-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-7541-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-21-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2012-18-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2264-11-0x0000000000400000-0x00000000006D3000-memory.dmp
                                        Download

                                        memory/2680-5-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2680-4-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2680-1-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2680-2-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download

                                        memory/2680-10-0x0000000000400000-0x0000000000486000-memory.dmp
                                        Download