Analysis
- max time kernel
110s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:35
General
- Target mKQqraplVchc4AK.exe
- Size 1.1MB
- Sample201109-xtehe7wdca
- SHA256 4fd457b5e2ff2430dbce5692ba6c47253ade9e105ffb192d01aee29d6ba7c912
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\Temp\109933CE9F\Log.txt
-
masslogger
- ################################################################# MassLogger v1.3.5.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 11/10/2020 9:40:42 PM MassLogger Started: 11/10/2020 9:40:40 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\mKQqraplVchc4AK.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:
Extracted
-
Protocol
smtp
-
Host
mail.privateemail.com
-
Port
587
-
Username
-
Password
MOREMONEY123
Signatures
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mKQqraplVchc4AK.exe"C:\Users\Admin\AppData\Local\Temp\mKQqraplVchc4AK.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TpKzJpK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76D7.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\mKQqraplVchc4AK.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/992-144-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-147-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-14-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/992-278-0x0000000007B10000-0x0000000007B1F000-memory.dmp
memory/992-277-0x0000000008010000-0x0000000008011000-memory.dmp
memory/992-274-0x0000000005400000-0x0000000005401000-memory.dmp
memory/992-273-0x0000000005180000-0x00000000051BE000-memory.dmp
memory/992-270-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-18-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-19-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-23-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-26-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-27-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-28-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-30-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-29-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-31-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-32-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-34-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-35-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-36-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-33-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-37-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-39-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-38-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-41-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-40-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-42-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-43-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-44-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-45-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-46-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-47-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-48-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-49-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-50-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-51-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-52-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-53-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-54-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-55-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-56-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-58-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-57-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-59-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-60-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-61-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-62-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-63-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-64-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-65-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-66-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-67-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-68-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-69-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-70-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-71-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-72-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-74-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-75-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-76-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-73-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-77-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-78-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-79-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-80-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-81-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-82-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-83-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-84-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-86-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-87-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-88-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-90-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-92-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-94-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-95-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-96-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-98-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-99-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-100-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-101-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-102-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-103-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-145-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-105-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-106-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-107-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-108-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-109-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-110-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-112-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-111-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-113-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-114-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-115-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-116-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-117-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-118-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-119-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-120-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-121-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-122-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-123-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-124-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-125-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-126-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-127-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-129-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-128-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-130-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-131-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-132-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-133-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-134-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-135-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-136-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-137-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-138-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-140-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-141-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-139-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-142-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-150-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-104-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-146-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-148-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-149-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-143-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-151-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-152-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-153-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-154-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-155-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-156-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-157-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-158-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-159-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-160-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-161-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-162-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-163-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-164-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-165-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-166-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-167-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-168-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-169-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-170-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-171-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-173-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-172-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-174-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-175-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-176-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-177-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-178-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-179-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-180-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-181-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-182-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-183-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-184-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-185-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-186-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-187-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-188-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-189-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-190-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-191-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-192-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-193-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-194-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-195-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-196-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-197-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-198-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-200-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-199-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-201-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-202-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-203-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-204-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-205-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-206-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-207-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-208-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-209-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-210-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-211-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-212-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-213-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-214-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-216-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-215-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-217-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-218-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-219-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-220-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-221-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-222-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-223-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-224-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-225-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-227-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-226-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-228-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-229-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-230-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-231-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-232-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-233-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-234-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-235-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-236-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-237-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-238-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-239-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-240-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-241-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-242-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-243-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-244-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-245-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-246-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-247-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-248-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-249-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-251-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-250-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-252-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-253-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-254-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-255-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-256-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-257-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-258-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-259-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-260-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-261-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-262-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-263-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-264-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-265-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-266-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-267-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-268-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/992-269-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4632-4-0x00000000075C0000-0x00000000075C1000-memory.dmp
memory/4632-3-0x0000000006FB0000-0x00000000070BF000-memory.dmp
memory/4632-1-0x0000000000100000-0x0000000000101000-memory.dmp
memory/4632-0-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/4632-5-0x00000000070C0000-0x00000000070C1000-memory.dmp
memory/4632-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/4632-7-0x0000000007320000-0x0000000007321000-memory.dmp
memory/4632-8-0x0000000004AC0000-0x0000000004AC2000-memory.dmp
memory/4632-9-0x0000000007D90000-0x0000000007E42000-memory.dmp