Overview

overview

10

Static

static

3

NerestPC_Reborn.exe

windows10-ltsc_2021-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    86s
  • max time network
    86s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    07/10/2026, 23:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NerestPC_Reborn.exe
  • Size 25.7MB
  • Sample261007-3ay8maxtcs
  • SHA256 672bd4b72ec9aa9c0f5c7a888a2133a29699417d46199e51b452ee0e34931456
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoverysalatstealerspywarestealerupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 38 IoCs
  • Checks computer location settings 2 TTPs 27 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary 1 TTPs 1 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 30 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • UPX packed file 47 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
    "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
      "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
        "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
          "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
            "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4808
            • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
              "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:1136
              • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:3520
                • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                  "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:4592
                  • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                    "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:3472
                    • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                      "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:992
                      • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                        "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:2344
                        • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                          "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                          12⤵
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:4488
                          • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                            "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                            13⤵
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:4116
                            • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                              "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                              14⤵
                              • Checks computer location settings
                              • Suspicious use of WriteProcessMemory
                              PID:2412
                              • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                15⤵
                                • Checks computer location settings
                                • Suspicious use of WriteProcessMemory
                                PID:5076
                                • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                  "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Suspicious use of WriteProcessMemory
                                  PID:3864
                                  • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                    "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Suspicious use of WriteProcessMemory
                                    PID:2268
                                    • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                      "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Suspicious use of WriteProcessMemory
                                      PID:3508
                                      • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                        "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Suspicious use of WriteProcessMemory
                                        PID:1280
                                        • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                          "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Suspicious use of WriteProcessMemory
                                          PID:4976
                                          • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                            "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Suspicious use of WriteProcessMemory
                                            PID:696
                                            • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                              "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Suspicious use of WriteProcessMemory
                                              PID:4972
                                              • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                23⤵
                                                • Checks computer location settings
                                                • Suspicious use of WriteProcessMemory
                                                PID:2524
                                                • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4284
                                                  • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3108
                                                    • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4468
                                                      • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:376
                                                        • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                          28⤵
                                                            PID:3168
                                                            • C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\NerestPC_Reborn.exe"
                                                              29⤵
                                                                PID:2352
                                                              • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                                29⤵
                                                                  PID:2800
                                                              • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                                28⤵
                                                                • Executes dropped EXE
                                                                • Reads the TCP/IP host and domain name from the registry
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4532
                                                            • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                              27⤵
                                                              • Executes dropped EXE
                                                              • Reads the TCP/IP host and domain name from the registry
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4232
                                                          • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                            26⤵
                                                            • Executes dropped EXE
                                                            • Reads the TCP/IP host and domain name from the registry
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2764
                                                        • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                          25⤵
                                                          • Executes dropped EXE
                                                          • Reads the TCP/IP host and domain name from the registry
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4832
                                                      • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                        24⤵
                                                        • Executes dropped EXE
                                                        • Reads the TCP/IP host and domain name from the registry
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3840
                                                    • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                      23⤵
                                                      • Executes dropped EXE
                                                      • Reads the TCP/IP host and domain name from the registry
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2700
                                                  • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                    22⤵
                                                    • Executes dropped EXE
                                                    • Reads the TCP/IP host and domain name from the registry
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5048
                                                • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                  21⤵
                                                  • Executes dropped EXE
                                                  • Reads the TCP/IP host and domain name from the registry
                                                  • System Location Discovery: System Language Discovery
                                                  PID:688
                                              • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                                "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                                20⤵
                                                • Executes dropped EXE
                                                • Reads the TCP/IP host and domain name from the registry
                                                • System Location Discovery: System Language Discovery
                                                PID:3012
                                            • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                              "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                              19⤵
                                              • Executes dropped EXE
                                              • Reads the TCP/IP host and domain name from the registry
                                              • System Location Discovery: System Language Discovery
                                              PID:4300
                                          • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                            "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                            18⤵
                                            • Executes dropped EXE
                                            • Reads the TCP/IP host and domain name from the registry
                                            • System Location Discovery: System Language Discovery
                                            PID:2120
                                        • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                          "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                          17⤵
                                          • Executes dropped EXE
                                          • Reads the TCP/IP host and domain name from the registry
                                          • System Location Discovery: System Language Discovery
                                          PID:792
                                      • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                        "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                        16⤵
                                        • Executes dropped EXE
                                        • Reads the TCP/IP host and domain name from the registry
                                        • System Location Discovery: System Language Discovery
                                        PID:1724
                                    • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                      "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                      15⤵
                                      • Executes dropped EXE
                                      • Reads the TCP/IP host and domain name from the registry
                                      • System Location Discovery: System Language Discovery
                                      PID:4576
                                  • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                    "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                    14⤵
                                    • Executes dropped EXE
                                    • Reads the TCP/IP host and domain name from the registry
                                    • System Location Discovery: System Language Discovery
                                    PID:4016
                                • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                  "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                  13⤵
                                  • Executes dropped EXE
                                  • Reads the TCP/IP host and domain name from the registry
                                  • System Location Discovery: System Language Discovery
                                  PID:3420
                              • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                                "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                                12⤵
                                • Executes dropped EXE
                                • Reads the TCP/IP host and domain name from the registry
                                • System Location Discovery: System Language Discovery
                                PID:4360
                            • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                              "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                              11⤵
                              • Executes dropped EXE
                              • Reads the TCP/IP host and domain name from the registry
                              • System Location Discovery: System Language Discovery
                              PID:772
                          • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                            "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                            10⤵
                            • Executes dropped EXE
                            • Reads the TCP/IP host and domain name from the registry
                            • System Location Discovery: System Language Discovery
                            PID:768
                        • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                          "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                          9⤵
                          • Executes dropped EXE
                          • Reads the TCP/IP host and domain name from the registry
                          • System Location Discovery: System Language Discovery
                          PID:4492
                      • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                        "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                        8⤵
                        • Executes dropped EXE
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        PID:3076
                    • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                      "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                      7⤵
                      • Executes dropped EXE
                      • Reads the TCP/IP host and domain name from the registry
                      • System Location Discovery: System Language Discovery
                      PID:3608
                  • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                    "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                    6⤵
                    • Executes dropped EXE
                    • Reads the TCP/IP host and domain name from the registry
                    • System Location Discovery: System Language Discovery
                    PID:5092
                • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                  "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                  5⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  PID:3604
              • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
                4⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:2552
            • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
              "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
              3⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              PID:5060
          • C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
            "C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe"
            2⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4216
            • C:\Users\Admin\AppData\Local\Comms\lsass.exe
              C:\Users\Admin\AppData\Local\Comms\lsass.exe
              3⤵
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4688
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3008
              • C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\lsass.exe" -
                4⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:3524
              • C:\Program Files\Google\Chrome\Application\lsass.exe
                "C:\Program Files\Google\Chrome\Application\lsass.exe" -
                4⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                PID:4428
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:2964
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:388

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  NerestPC_Reborn.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NerestPC_Reborn.exe.log
                  • Size 654B
                  • SHA256 d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  NerestPCReborn.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\NerestPCReborn.exe
                  • Size 3.4MB
                  • SHA256 3e5807eec9962d5950718f3eac1163b51d6ee4346539d1a913493515eb5ab725
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_r4hmugmh.gaz.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4hmugmh.gaz.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/688-229-0x0000000000FA0000-0x0000000001BF5000-memory.dmp
                  Download

                  memory/768-46-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/772-63-0x00000000000B0000-0x0000000000D05000-memory.dmp
                  Download

                  memory/792-136-0x00000000007C0000-0x0000000001415000-memory.dmp
                  Download

                  memory/1124-15-0x0000000002D90000-0x0000000002DA0000-memory.dmp
                  Download

                  memory/1724-124-0x0000000000920000-0x0000000001575000-memory.dmp
                  Download

                  memory/2120-149-0x0000000000280000-0x0000000000ED5000-memory.dmp
                  Download

                  memory/2552-22-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/2552-23-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/2700-257-0x0000000000730000-0x0000000001385000-memory.dmp
                  Download

                  memory/2764-294-0x0000000000B80000-0x00000000017D5000-memory.dmp
                  Download

                  memory/2800-331-0x0000000000D30000-0x0000000001985000-memory.dmp
                  Download

                  memory/3008-226-0x0000000007F40000-0x0000000007FE3000-memory.dmp
                  Download

                  memory/3008-227-0x0000000008040000-0x000000000804A000-memory.dmp
                  Download

                  memory/3008-231-0x0000000008FE0000-0x0000000009586000-memory.dmp
                  Download

                  memory/3008-230-0x0000000008A00000-0x0000000008A22000-memory.dmp
                  Download

                  memory/3008-228-0x00000000080F0000-0x0000000008186000-memory.dmp
                  Download

                  memory/3008-215-0x0000000007EE0000-0x0000000007F12000-memory.dmp
                  Download

                  memory/3008-217-0x0000000070CF0000-0x0000000071047000-memory.dmp
                  Download

                  memory/3008-225-0x0000000007F20000-0x0000000007F3E000-memory.dmp
                  Download

                  memory/3008-216-0x0000000070AB0000-0x0000000070AFC000-memory.dmp
                  Download

                  memory/3008-203-0x0000000007D20000-0x0000000007D3A000-memory.dmp
                  Download

                  memory/3008-202-0x0000000008380000-0x00000000089FA000-memory.dmp
                  Download

                  memory/3008-198-0x0000000007A80000-0x0000000007AF6000-memory.dmp
                  Download

                  memory/3008-187-0x0000000006F20000-0x0000000006F64000-memory.dmp
                  Download

                  memory/3008-185-0x0000000006A10000-0x0000000006A5C000-memory.dmp
                  Download

                  memory/3008-180-0x0000000006960000-0x000000000697E000-memory.dmp
                  Download

                  memory/3008-177-0x0000000006370000-0x00000000066C7000-memory.dmp
                  Download

                  memory/3008-158-0x0000000006290000-0x00000000062F6000-memory.dmp
                  Download

                  memory/3008-159-0x0000000006300000-0x0000000006366000-memory.dmp
                  Download

                  memory/3008-157-0x00000000058E0000-0x0000000005902000-memory.dmp
                  Download

                  memory/3008-155-0x0000000005AC0000-0x000000000618A000-memory.dmp
                  Download

                  memory/3008-154-0x0000000002F80000-0x0000000002FB6000-memory.dmp
                  Download

                  memory/3012-201-0x00000000002A0000-0x0000000000EF5000-memory.dmp
                  Download

                  memory/3076-39-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/3076-38-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/3420-87-0x0000000000470000-0x00000000010C5000-memory.dmp
                  Download

                  memory/3524-156-0x0000000000240000-0x0000000000E95000-memory.dmp
                  Download

                  memory/3604-28-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/3604-26-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/3608-35-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/3608-36-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/3788-0-0x0000000000640000-0x0000000001FEE000-memory.dmp
                  Download

                  memory/3788-1-0x000000001CD30000-0x000000001CD40000-memory.dmp
                  Download

                  memory/3840-270-0x0000000000230000-0x0000000000E85000-memory.dmp
                  Download

                  memory/4016-100-0x00000000009B0000-0x0000000001605000-memory.dmp
                  Download

                  memory/4216-29-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4216-14-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4216-52-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4216-25-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4216-40-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4232-307-0x0000000000380000-0x0000000000FD5000-memory.dmp
                  Download

                  memory/4300-179-0x0000000000710000-0x0000000001365000-memory.dmp
                  Download

                  memory/4360-75-0x0000000000AA0000-0x00000000016F5000-memory.dmp
                  Download

                  memory/4428-186-0x00000000004A0000-0x00000000010F5000-memory.dmp
                  Download

                  memory/4492-42-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4492-44-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/4532-319-0x0000000000920000-0x0000000001575000-memory.dmp
                  Download

                  memory/4576-112-0x0000000000970000-0x00000000015C5000-memory.dmp
                  Download

                  memory/4688-200-0x0000000000BF0000-0x0000000001845000-memory.dmp
                  Download

                  memory/4688-295-0x0000000000BF0000-0x0000000001845000-memory.dmp
                  Download

                  memory/4688-258-0x0000000000BF0000-0x0000000001845000-memory.dmp
                  Download

                  memory/4688-137-0x0000000000BF0000-0x0000000001845000-memory.dmp
                  Download

                  memory/4688-88-0x0000000000BF0000-0x0000000001845000-memory.dmp
                  Download

                  memory/4832-282-0x0000000000400000-0x0000000001055000-memory.dmp
                  Download

                  memory/5048-245-0x0000000000B00000-0x0000000001755000-memory.dmp
                  Download

                  memory/5060-20-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/5060-18-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/5092-31-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download

                  memory/5092-33-0x0000000000640000-0x0000000001295000-memory.dmp
                  Download