Analysis
- max time kernel
80s - max time network
115s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:25
General
- Target 0a2cb4e2898995c1e54579f6af302176.exe
- Size 881KB
- Sample201109-jedc7hl5ma
- SHA256 c5caffb818f7a64275b1188abf255ddbfb285fbf78378d77c4b2a29f2377bd33
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\109933CE9F\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/10/2020 5:32:24 PM MassLogger Started: 11/10/2020 5:32:20 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\0a2cb4e2898995c1e54579f6af302176.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Extracted
-
Protocol
smtp
-
Host
mail.mytravelexplorer.com
-
Port
587
-
Username
-
Password
43K+H2..0_g^
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a2cb4e2898995c1e54579f6af302176.exe"C:\Users\Admin\AppData\Local\Temp\0a2cb4e2898995c1e54579f6af302176.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GyQuklvk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDF1B.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\0a2cb4e2898995c1e54579f6af302176.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1872-144-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-87-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-278-0x0000000007BF0000-0x0000000007BFF000-memory.dmp
memory/1872-277-0x0000000007FE0000-0x0000000007FE1000-memory.dmp
memory/1872-274-0x0000000005520000-0x0000000005521000-memory.dmp
memory/1872-273-0x0000000005330000-0x000000000536E000-memory.dmp
memory/1872-14-0x0000000073E30000-0x000000007451E000-memory.dmp
memory/1872-18-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-19-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-23-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-26-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-27-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-28-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-29-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-30-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-32-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-31-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-34-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-33-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-35-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-36-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-37-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-38-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-39-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-41-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-40-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-42-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-43-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-44-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-45-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-46-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-47-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-48-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-49-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-50-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-51-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-52-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-53-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-54-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-55-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-56-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-57-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-58-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-59-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-61-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-60-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-62-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-63-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-64-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-65-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-67-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-66-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-68-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-69-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-70-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-72-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-71-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-73-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-74-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-75-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-76-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-77-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-78-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-79-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-80-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-81-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-82-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-83-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-143-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-146-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-88-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-84-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-92-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-94-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-95-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-96-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-98-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-99-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-100-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-101-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-103-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-102-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-104-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-105-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-106-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-107-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-108-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-109-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-110-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-111-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-112-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-113-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-114-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-115-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-116-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-117-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-118-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-120-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-119-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-121-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-122-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-123-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-125-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-124-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-126-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-127-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-128-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-130-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-129-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-131-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-132-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-133-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-134-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-135-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-136-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-137-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-138-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-139-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-140-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-141-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-142-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-145-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-90-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-86-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-147-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-148-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-149-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-150-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-151-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-152-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-153-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-154-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-155-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-156-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-157-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-158-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-159-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-160-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-162-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-161-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-163-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-165-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-164-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-167-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-166-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-168-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-169-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-170-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-171-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-172-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-173-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-174-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-176-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-175-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-177-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-178-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-179-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-180-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-181-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-182-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-183-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-184-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-185-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-186-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-187-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-188-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-189-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-190-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-192-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-191-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-193-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-194-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-195-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-196-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-197-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-198-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-199-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-200-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-201-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-202-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-204-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-203-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-206-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-205-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-207-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-208-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-210-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-211-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-212-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-209-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-213-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-214-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-215-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-216-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-218-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-217-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-219-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-220-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-222-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-221-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-223-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-225-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-224-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-226-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-228-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-229-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-227-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-231-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-230-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-232-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-233-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-234-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-236-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-235-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-238-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-237-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-239-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-240-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-241-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-242-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-243-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-244-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-245-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-246-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-248-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-247-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-249-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-250-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-251-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-252-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-253-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-254-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-255-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-256-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-257-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-258-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-259-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-260-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-261-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-262-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-263-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-264-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-265-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-266-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-267-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-268-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-269-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1872-270-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4644-3-0x0000000005C20000-0x0000000005C21000-memory.dmp
memory/4644-1-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/4644-0-0x0000000073E30000-0x000000007451E000-memory.dmp
memory/4644-4-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/4644-5-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/4644-6-0x0000000005980000-0x0000000005982000-memory.dmp
memory/4644-7-0x0000000009320000-0x00000000093D2000-memory.dmp
memory/4644-8-0x0000000009480000-0x0000000009481000-memory.dmp