Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/06/2024, 23:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a684e5308b5ec3d09a9bd982d7396290f29bcbe67fd9e9b2683545a9b746d94c.exe
  • Size 1.8MB
  • Sample240627-26dfcsxcne
  • SHA256 a684e5308b5ec3d09a9bd982d7396290f29bcbe67fd9e9b2683545a9b746d94c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummaredlinestealc123e76b71jopadiscoveryevasionexecutioninfostealerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 8254624243

Botnet

  • e76b71

C2

  • http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • 123

C2

  • 185.215.113.67:40960

Extracted

Family

  • stealc

Botnet

  • jopa

C2

  • http://65.21.175.0

Attributes
  • url_path

    /108e010e8f91c38c.php

Extracted

Family

  • lumma

C2

  • https://harmfullyelobardek.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a684e5308b5ec3d09a9bd982d7396290f29bcbe67fd9e9b2683545a9b746d94c.exe
    "C:\Users\Admin\AppData\Local\Temp\a684e5308b5ec3d09a9bd982d7396290f29bcbe67fd9e9b2683545a9b746d94c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Users\Admin\AppData\Local\Temp\1000035001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1000035001\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:716
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 324
            4⤵
            • Program crash
            PID:688
        • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
          "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3332
          • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:1908
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 500
                6⤵
                • Program crash
                PID:1704
            • C:\Users\Admin\AppData\Local\Temp\1000023001\FirstZ.exe
              "C:\Users\Admin\AppData\Local\Temp\1000023001\FirstZ.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              PID:3284
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1424
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4380
                • C:\Windows\system32\wusa.exe
                  wusa /uninstall /kb:890830 /quiet /norestart
                  7⤵
                    PID:2644
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop UsoSvc
                  6⤵
                  • Launches sc.exe
                  PID:2156
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                  6⤵
                  • Launches sc.exe
                  PID:2948
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop wuauserv
                  6⤵
                  • Launches sc.exe
                  PID:4472
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop bits
                  6⤵
                  • Launches sc.exe
                  PID:4476
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop dosvc
                  6⤵
                  • Launches sc.exe
                  PID:1624
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4636
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4164
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4284
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4960
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe delete "WSNKISKT"
                  6⤵
                  • Launches sc.exe
                  PID:2228
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                  6⤵
                  • Launches sc.exe
                  PID:4656
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop eventlog
                  6⤵
                  • Launches sc.exe
                  PID:2164
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe start "WSNKISKT"
                  6⤵
                  • Launches sc.exe
                  PID:1384
          • C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe
            "C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe"
            3⤵
            • Executes dropped EXE
            PID:4724
          • C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
            "C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe"
            3⤵
            • Executes dropped EXE
            PID:1896
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
              4⤵
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4384
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 1048
                5⤵
                • Program crash
                PID:612
      • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:1320
      • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:528
      • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        1⤵
        • Executes dropped EXE
        PID:4592
      • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2400
      • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        1⤵
        • Executes dropped EXE
        PID:368
      • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        1⤵
        • Executes dropped EXE
        PID:5084
      • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:796
      • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
        1⤵
        • Executes dropped EXE
        PID:1492
      • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3848
      • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
        C:\ProgramData\wikombernizc\reakuqnanrkn.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Windows\system32\wusa.exe
            wusa /uninstall /kb:890830 /quiet /norestart
            3⤵
              PID:784
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop UsoSvc
            2⤵
            • Launches sc.exe
            PID:1688
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop WaaSMedicSvc
            2⤵
            • Launches sc.exe
            PID:1864
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop wuauserv
            2⤵
            • Launches sc.exe
            PID:2480
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop bits
            2⤵
            • Launches sc.exe
            PID:3012
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop dosvc
            2⤵
            • Launches sc.exe
            PID:4640
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:3192
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4372
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:668
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:4476
          • C:\Windows\system32\conhost.exe
            C:\Windows\system32\conhost.exe
            2⤵
              PID:3636
            • C:\Windows\explorer.exe
              explorer.exe
              2⤵
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4168

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                1.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe
                • Size 317KB
                • SHA256 d5bba713d11ebbb7a91be59dae0f2d4b818897fe756b854dfe40babe7664c173
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                FirstZ.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000023001\FirstZ.exe
                • Size 2.5MB
                • SHA256 677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                crypted.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000035001\crypted.exe
                • Size 529KB
                • SHA256 6ea5dc63bda788cd58bcbc5d9c736f7ba1d01371a9d05c53134616c2776c6314
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                NewLatest.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
                • Size 415KB
                • SHA256 488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                123.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe
                • Size 297KB
                • SHA256 a2ebb4bbf2ae4f7755b3ab604996e6c7e570ac8837ca544854ed696a81972505
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                streamer.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000111001\streamer.exe
                • Size 944KB
                • SHA256 39c3d69f90b21c200535a77a355623a9171a6c2925e7a9d0dd01ec92eabab57a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                TpWWMUpe0LEV.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
                • Size 1.2MB
                • SHA256 bac402b5749b2da2211db6d2404c1c621ccd0c2e5d492eb6f973b3e2d38dd361
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                build.exe
                • Path C:\Users\Admin\AppData\Local\Temp\1000115001\build.exe
                • Size 1.8MB
                • SHA256 a37dabf64f29b8ccac3edba64b1aae522e858ffe9856a8db96bc686e2fdb8d77
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                axplong.exe
                • Path C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                • Size 1.8MB
                • SHA256 a684e5308b5ec3d09a9bd982d7396290f29bcbe67fd9e9b2683545a9b746d94c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                __PSScriptPolicyTest_tbzolxcz.glx.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tbzolxcz.glx.ps1
                • Size 1B
                • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                • MD5 SHA1 SHA512
                Submit Download

                memory/196-335-0x000001E09FBA0000-0x000001E09FBAA000-memory.dmp
                Download

                memory/196-302-0x000001E0A0080000-0x000001E0A0139000-memory.dmp
                Download

                memory/196-296-0x000001E09FB80000-0x000001E09FB9C000-memory.dmp
                Download

                memory/528-112-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/528-114-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/716-43-0x0000000000400000-0x000000000045A000-memory.dmp
                Download

                memory/716-44-0x0000000000400000-0x000000000045A000-memory.dmp
                Download

                memory/796-184-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/796-185-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1320-27-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1320-26-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1424-221-0x000001E7B6180000-0x000001E7B61F6000-memory.dmp
                Download

                memory/1424-217-0x000001E7B5FC0000-0x000001E7B5FE2000-memory.dmp
                Download

                memory/1736-131-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-15-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-16-0x0000000000EB1000-0x0000000000EDF000-memory.dmp
                Download

                memory/1736-209-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-207-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-204-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-17-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-190-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-189-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-187-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-91-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-18-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-96-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-109-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-58-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-45-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-30-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-128-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-19-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-130-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-181-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-133-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-136-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-138-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-179-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-144-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-146-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-29-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-158-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-28-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1736-176-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/1896-174-0x0000000000A30000-0x0000000000ADE000-memory.dmp
                Download

                memory/1908-129-0x0000000000400000-0x000000000236B000-memory.dmp
                Download

                memory/2400-142-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/3636-425-0x0000000140000000-0x000000014000E000-memory.dmp
                Download

                memory/3636-431-0x0000000140000000-0x000000014000E000-memory.dmp
                Download

                memory/3636-424-0x0000000140000000-0x000000014000E000-memory.dmp
                Download

                memory/3636-428-0x0000000140000000-0x000000014000E000-memory.dmp
                Download

                memory/3636-426-0x0000000140000000-0x000000014000E000-memory.dmp
                Download

                memory/3636-427-0x0000000140000000-0x000000014000E000-memory.dmp
                Download

                memory/3848-212-0x0000000000EB0000-0x000000000134A000-memory.dmp
                Download

                memory/4168-433-0x0000000140000000-0x0000000140848000-memory.dmp
                Download

                memory/4168-435-0x0000000140000000-0x0000000140848000-memory.dmp
                Download

                memory/4168-434-0x0000000140000000-0x0000000140848000-memory.dmp
                Download

                memory/4168-432-0x0000000140000000-0x0000000140848000-memory.dmp
                Download

                memory/4384-173-0x0000000000400000-0x000000000063C000-memory.dmp
                Download

                memory/4724-86-0x0000000004FD0000-0x000000000500E000-memory.dmp
                Download

                memory/4724-83-0x0000000005CB0000-0x00000000062B6000-memory.dmp
                Download

                memory/4724-92-0x0000000005920000-0x0000000005986000-memory.dmp
                Download

                memory/4724-87-0x0000000005010000-0x000000000505B000-memory.dmp
                Download

                memory/4724-85-0x0000000004F60000-0x0000000004F72000-memory.dmp
                Download

                memory/4724-84-0x00000000056A0000-0x00000000057AA000-memory.dmp
                Download

                memory/4724-79-0x0000000000460000-0x00000000004B0000-memory.dmp
                Download

                memory/4724-80-0x00000000051A0000-0x000000000569E000-memory.dmp
                Download

                memory/4724-81-0x0000000004D40000-0x0000000004DD2000-memory.dmp
                Download

                memory/4724-82-0x0000000004D10000-0x0000000004D1A000-memory.dmp
                Download

                memory/4892-14-0x0000000000020000-0x00000000004BA000-memory.dmp
                Download

                memory/4892-1-0x00000000773B4000-0x00000000773B5000-memory.dmp
                Download

                memory/4892-2-0x0000000000021000-0x000000000004F000-memory.dmp
                Download

                memory/4892-3-0x0000000000020000-0x00000000004BA000-memory.dmp
                Download

                memory/4892-5-0x0000000000020000-0x00000000004BA000-memory.dmp
                Download

                memory/4892-0-0x0000000000020000-0x00000000004BA000-memory.dmp
                Download