Overview

overview

10

Static

static

3

fcc0bab24c...2f.exe

windows7-x64

10

fcc0bab24c...2f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2024, 05:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fcc0bab24c5bad169e105b500cbfa6ec59d82fba1bb466c706f138dc7e91582f.exe
  • Size 3.1MB
  • Sample241113-f3v1cawkft
  • SHA256 fcc0bab24c5bad169e105b500cbfa6ec59d82fba1bb466c706f138dc7e91582f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylumma9c9aa5discoveryevasionpersistencestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://thicktoys.sbs/api

  • https://3xc1aimbl0w.sbs/api

  • https://300snails.sbs/api

  • https://faintbl0w.sbs/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\fcc0bab24c5bad169e105b500cbfa6ec59d82fba1bb466c706f138dc7e91582f.exe
        "C:\Users\Admin\AppData\Local\Temp\fcc0bab24c5bad169e105b500cbfa6ec59d82fba1bb466c706f138dc7e91582f.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Users\Admin\AppData\Local\Temp\1005893001\oi.exe
            "C:\Users\Admin\AppData\Local\Temp\1005893001\oi.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3284
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4276
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5108
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4548
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4764
              • C:\Windows\SysWOW64\findstr.exe
                findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1004
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 27375
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2212
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "optimizationsquarerehabseq" Tech
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3904
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Maintained + ..\Bryan + ..\Ace + ..\Stored + ..\Concerts + ..\Tiny + ..\Simplified G
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5000
              • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                Lovely.pif G
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3948
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks.exe /create /tn "ZenFlow" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc onlogon /F /RL HIGHEST
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3056
                • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3860
                • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1848
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 15
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1344
          • C:\Users\Admin\AppData\Local\Temp\1005894001\oi.exe
            "C:\Users\Admin\AppData\Local\Temp\1005894001\oi.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1600
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4828
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:5096
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3360
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:492
              • C:\Windows\SysWOW64\findstr.exe
                findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3412
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 27375
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1064
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Maintained + ..\Bryan + ..\Ace + ..\Stored + ..\Concerts + ..\Tiny + ..\Simplified G
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4764
              • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                Lovely.pif G
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4768
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 15
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3980
          • C:\Users\Admin\AppData\Local\Temp\1005899001\166a6833ae.exe
            "C:\Users\Admin\AppData\Local\Temp\1005899001\166a6833ae.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4796
          • C:\Users\Admin\AppData\Local\Temp\1005900001\cca1627efd.exe
            "C:\Users\Admin\AppData\Local\Temp\1005900001\cca1627efd.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:5092
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
              PID:3768
            • C:\Users\Admin\AppData\Local\Temp\1005902001\002875ffdd.exe
              "C:\Users\Admin\AppData\Local\Temp\1005902001\002875ffdd.exe"
              4⤵
              • Modifies Windows Defender Real-time Protection settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3412
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c schtasks.exe /create /tn "Total" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3592
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "Total" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:4128
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:3484
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:1588

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Modify Registry

            3
            T1112

            Virtualization/Sandbox Evasion

            2
            T1497

            Credential Access

            Discovery

            Process Discovery

            1
            T1057

            Query Registry

            4
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Virtualization/Sandbox Evasion

            2
            T1497

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            oi.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1005893001\oi.exe
            • Size 1009KB
            • SHA256 bb653dddd858f686a07ac236a6098d9da8dcb8524aedc8da2cb5a6f084cbfebc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            166a6833ae.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1005899001\166a6833ae.exe
            • Size 3.0MB
            • SHA256 57f65d2dda83f30fb63f6dad1c0eec4ec3124c024570f120ac24014b440732bd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cca1627efd.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1005900001\cca1627efd.exe
            • Size 1.7MB
            • SHA256 34976e3a19551998f88db1deaec6904616f92fefeb2a01350a1fab6c63492ec6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            002875ffdd.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1005902001\002875ffdd.exe
            • Size 2.7MB
            • SHA256 af3b24db892a76118b050469af21103260a4e66d99184dd8a10ba185b8b03b0a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            G
            • Path C:\Users\Admin\AppData\Local\Temp\27375\G
            • Size 518KB
            • SHA256 10bcb2925540219372c72f31dd5766be5850ff2a993ada75f73c8ab429aea077
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Lovely.pif
            • Path C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
            • Size 921KB
            • SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Ace
            • Path C:\Users\Admin\AppData\Local\Temp\Ace
            • Size 86KB
            • SHA256 6c9a4bce60a8b019f5b74cc9861ed3da801ecc7127e4fb8199ff310274e6a6db
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Advertiser
            • Path C:\Users\Admin\AppData\Local\Temp\Advertiser
            • Size 909KB
            • SHA256 f3df9dd5028e882d651cc871a673f9811b15114e8915375b93bc72b6b93e2733
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Bryan
            • Path C:\Users\Admin\AppData\Local\Temp\Bryan
            • Size 84KB
            • SHA256 d62ef368aca33c0c7503b469a5701919cc8524310c624182f5243c913d33ca70
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Concerts
            • Path C:\Users\Admin\AppData\Local\Temp\Concerts
            • Size 98KB
            • SHA256 d5d97b1f80d3680d5177cecb173bb7032379e7e8afa4763a09b7cc00b511ea8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Maintained
            • Path C:\Users\Admin\AppData\Local\Temp\Maintained
            • Size 88KB
            • SHA256 a843a39f214722b5e878a6c29114b9e71efe5842147f2e79dfa48ae762430679
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Simplified
            • Path C:\Users\Admin\AppData\Local\Temp\Simplified
            • Size 22KB
            • SHA256 f5c0563e8cb841e8ca1b1480eb512334f1a9c4f0172a21d39514c37d4c6eb8af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Stored
            • Path C:\Users\Admin\AppData\Local\Temp\Stored
            • Size 72KB
            • SHA256 144ad9f5e00905fe457459e5501b341e1523d37c6a5947efe2a12e01c103ca21
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Tech
            • Path C:\Users\Admin\AppData\Local\Temp\Tech
            • Size 12KB
            • SHA256 24c658f99200081bceae83740631ab7326b8a328f23364104c9e534d191ffb28
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Tiny
            • Path C:\Users\Admin\AppData\Local\Temp\Tiny
            • Size 68KB
            • SHA256 0cd19abfc3719aaf60e84529980afb15b58e753980b9d089dff32913a9b8e88b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uh
            • Path C:\Users\Admin\AppData\Local\Temp\Uh
            • Size 12KB
            • SHA256 717fb7062ce364fbb54c89e1aba5a0de1e3bf3bc239b6c6cdc4972aa6f96fee3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            skotes.exe
            • Path C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            • Size 3.1MB
            • SHA256 fcc0bab24c5bad169e105b500cbfa6ec59d82fba1bb466c706f138dc7e91582f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1588-509-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/1588-510-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/1848-505-0x0000000001460000-0x00000000014B6000-memory.dmp
            Download

            memory/1848-507-0x0000000001460000-0x00000000014B6000-memory.dmp
            Download

            memory/2112-442-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-513-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-194-0x0000000000551000-0x00000000005B9000-memory.dmp
            Download

            memory/2112-44-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-22-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-21-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-20-0x0000000000551000-0x00000000005B9000-memory.dmp
            Download

            memory/2112-415-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-498-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-515-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-500-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-514-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-501-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-499-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-512-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-511-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-19-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-502-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-504-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-489-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2112-195-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/2420-4-0x00000000002C0000-0x00000000005D2000-memory.dmp
            Download

            memory/2420-3-0x00000000002C0000-0x00000000005D2000-memory.dmp
            Download

            memory/2420-2-0x00000000002C1000-0x0000000000329000-memory.dmp
            Download

            memory/2420-1-0x0000000077294000-0x0000000077296000-memory.dmp
            Download

            memory/2420-18-0x00000000002C1000-0x0000000000329000-memory.dmp
            Download

            memory/2420-0-0x00000000002C0000-0x00000000005D2000-memory.dmp
            Download

            memory/2420-17-0x00000000002C0000-0x00000000005D2000-memory.dmp
            Download

            memory/3412-488-0x0000000000860000-0x0000000000B14000-memory.dmp
            Download

            memory/3412-487-0x0000000000860000-0x0000000000B14000-memory.dmp
            Download

            memory/3412-493-0x0000000000860000-0x0000000000B14000-memory.dmp
            Download

            memory/3412-484-0x0000000000860000-0x0000000000B14000-memory.dmp
            Download

            memory/3412-497-0x0000000000860000-0x0000000000B14000-memory.dmp
            Download

            memory/3484-491-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/3484-492-0x0000000000550000-0x0000000000862000-memory.dmp
            Download

            memory/3860-486-0x0000000000580000-0x00000000005D6000-memory.dmp
            Download

            memory/3860-473-0x0000000000580000-0x00000000005D6000-memory.dmp
            Download

            memory/3860-464-0x0000000000580000-0x00000000005D6000-memory.dmp
            Download

            memory/4796-444-0x0000000000580000-0x000000000088B000-memory.dmp
            Download

            memory/4796-440-0x0000000000580000-0x000000000088B000-memory.dmp
            Download

            memory/5092-462-0x0000000000070000-0x00000000006F9000-memory.dmp
            Download

            memory/5092-460-0x0000000000070000-0x00000000006F9000-memory.dmp
            Download