Analysis
- max time kernel
150s - max time network
143s - platform
windows10_x64 - resource
win10v20210410 - submitted
20/05/2021, 19:06
General
- Target 390bd3e463727b5545de6f128c1596bf.exe
- Size 7.3MB
- Sample210520-ddkdhdved2
- SHA256 e13ba9f6e63e4013b75c3d45b012d8cbdda80913669bdd10942828b05d66e798
Malware Config
Extracted
-
vidar
-
38.7
-
827
-
https://HAL9THapi.faceit.comramilgame
-
profile_id
827
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars Payload 2 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Vidar Stealer 2 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 2 IoCs
- Executes dropped EXE 30 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 14 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 13 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\390bd3e463727b5545de6f128c1596bf.exe"C:\Users\Admin\AppData\Local\Temp\390bd3e463727b5545de6f128c1596bf.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\4536427.exe"C:\Users\Admin\AppData\Roaming\4536427.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\5208280.exe"C:\Users\Admin\AppData\Roaming\5208280.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\1055919.exe"C:\Users\Admin\AppData\Roaming\1055919.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 19924⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe"C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\is-HLLI9.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-HLLI9.tmp\lylal220.tmp" /SL5="$50070,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7AK7U.tmp\4_177039.exe"C:\Users\Admin\AppData\Local\Temp\is-7AK7U.tmp\4_177039.exe" /S /UID=lylal2202⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Mozilla Firefox\VWXLHCHPRX\irecord.exe"C:\Program Files\Mozilla Firefox\VWXLHCHPRX\irecord.exe" /VERYSILENT3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-88233.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-88233.tmp\irecord.tmp" /SL5="$30228,6139911,56832,C:\Program Files\Mozilla Firefox\VWXLHCHPRX\irecord.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\84-051db-a4e-a918a-fa632dfe8fc0b\Qahedymaety.exe"C:\Users\Admin\AppData\Local\Temp\84-051db-a4e-a918a-fa632dfe8fc0b\Qahedymaety.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\5e-ec37c-dc6-6f488-c556408d321ef\Vilaelozhiha.exe"C:\Users\Admin\AppData\Local\Temp\5e-ec37c-dc6-6f488-c556408d321ef\Vilaelozhiha.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-L55J4.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-L55J4.tmp\LabPicV3.tmp" /SL5="$6005A,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5IS7G.tmp\3316505.exe"C:\Users\Admin\AppData\Local\Temp\is-5IS7G.tmp\3316505.exe" /S /UID=lab2142⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Uninstall Information\OSZEQWDDQL\prolab.exe"C:\Program Files\Uninstall Information\OSZEQWDDQL\prolab.exe" /VERYSILENT3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-FNDK5.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-FNDK5.tmp\prolab.tmp" /SL5="$301EC,575243,216576,C:\Program Files\Uninstall Information\OSZEQWDDQL\prolab.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\7d-b022f-832-6c889-d9d3ec27eccec\Petavimyvae.exe"C:\Users\Admin\AppData\Local\Temp\7d-b022f-832-6c889-d9d3ec27eccec\Petavimyvae.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\55-034b5-fe1-ce497-e4a0f2b0d1abc\Pisupinamae.exe"C:\Users\Admin\AppData\Local\Temp\55-034b5-fe1-ce497-e4a0f2b0d1abc\Pisupinamae.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/200-159-0x0000000000400000-0x000000000065D000-memory.dmp
memory/348-260-0x00000227A5F90000-0x00000227A6000000-memory.dmp
memory/780-218-0x00000240216A0000-0x0000024021710000-memory.dmp
memory/1020-229-0x000002B851100000-0x000002B851170000-memory.dmp
memory/1108-217-0x000001DAA5910000-0x000001DAA5980000-memory.dmp
memory/1228-255-0x00000201DA510000-0x00000201DA580000-memory.dmp
memory/1272-261-0x0000018A9E0C0000-0x0000018A9E130000-memory.dmp
memory/1388-239-0x000001F84EB20000-0x000001F84EB90000-memory.dmp
memory/1412-208-0x00000000030B0000-0x00000000030B2000-memory.dmp
memory/1864-248-0x0000029DB56B0000-0x0000029DB5720000-memory.dmp
memory/2080-130-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2080-140-0x0000000005B90000-0x0000000005B91000-memory.dmp
memory/2080-153-0x0000000005690000-0x0000000005B8E000-memory.dmp
memory/2080-161-0x0000000005660000-0x0000000005661000-memory.dmp
memory/2080-149-0x0000000005690000-0x0000000005691000-memory.dmp
memory/2320-158-0x0000000001190000-0x00000000017EF000-memory.dmp
memory/2356-204-0x0000000002EB0000-0x0000000002EB2000-memory.dmp
memory/2380-205-0x0000018472F60000-0x0000018472FD0000-memory.dmp
memory/2408-195-0x0000017F63070000-0x0000017F630E0000-memory.dmp
memory/2408-191-0x0000017F628B0000-0x0000017F628FB000-memory.dmp
memory/2432-236-0x0000000002160000-0x00000000021F7000-memory.dmp
memory/2432-232-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/2580-227-0x000001B713E00000-0x000001B713E70000-memory.dmp
memory/2612-327-0x0000000002860000-0x0000000002862000-memory.dmp
memory/2656-145-0x0000000002740000-0x0000000002741000-memory.dmp
memory/2656-154-0x0000000002750000-0x000000000276D000-memory.dmp
memory/2656-160-0x0000000002770000-0x0000000002771000-memory.dmp
memory/2656-129-0x0000000000870000-0x0000000000871000-memory.dmp
memory/2656-164-0x000000001B380000-0x000000001B382000-memory.dmp
memory/2688-280-0x0000018AA5A00000-0x0000018AA5A70000-memory.dmp
memory/2696-277-0x000001371A060000-0x000001371A0D0000-memory.dmp
memory/3092-135-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3412-166-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3420-189-0x00000000043B5000-0x00000000044B6000-memory.dmp
memory/3420-194-0x0000000002BF0000-0x0000000002C4C000-memory.dmp
memory/3632-259-0x000002144A570000-0x000002144A5E0000-memory.dmp
memory/3632-299-0x000002144CA00000-0x000002144CB06000-memory.dmp
memory/3736-165-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/3844-328-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/4004-138-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4048-323-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4188-338-0x0000000065EC0000-0x0000000067271000-memory.dmp
memory/4188-333-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/4188-341-0x0000000000DD5000-0x0000000000DD7000-memory.dmp
memory/4188-335-0x0000000000DD1000-0x0000000000DD2000-memory.dmp
memory/4188-334-0x000000006AB00000-0x000000006AD71000-memory.dmp
memory/4188-340-0x0000000005CC0000-0x0000000007071000-memory.dmp
memory/4188-339-0x0000000000DD2000-0x0000000000DD3000-memory.dmp
memory/4228-241-0x0000000002710000-0x0000000002711000-memory.dmp
memory/4228-198-0x0000000000530000-0x0000000000531000-memory.dmp
memory/4228-250-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/4228-238-0x0000000004E10000-0x0000000004E4C000-memory.dmp
memory/4228-213-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/4304-331-0x0000000002170000-0x0000000002172000-memory.dmp
memory/4304-337-0x0000000002172000-0x0000000002174000-memory.dmp
memory/4320-212-0x00000000008F0000-0x00000000008F1000-memory.dmp
memory/4320-249-0x0000000005320000-0x0000000005321000-memory.dmp
memory/4320-235-0x0000000005210000-0x0000000005211000-memory.dmp
memory/4320-237-0x0000000004A80000-0x0000000004A90000-memory.dmp
memory/4320-223-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/4380-306-0x0000000002CA0000-0x0000000002CA2000-memory.dmp
memory/4476-244-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/4476-230-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/4476-278-0x0000000002870000-0x0000000002871000-memory.dmp
memory/4476-262-0x000000000A2B0000-0x000000000A2EA000-memory.dmp
memory/4476-264-0x0000000000F80000-0x0000000000F81000-memory.dmp
memory/4788-336-0x00000000051D0000-0x00000000057D6000-memory.dmp
memory/4840-321-0x00000000008C4000-0x00000000008C5000-memory.dmp
memory/4840-310-0x00000000008C0000-0x00000000008C2000-memory.dmp
memory/4840-314-0x00000000008C2000-0x00000000008C4000-memory.dmp
memory/4880-297-0x0000000000400000-0x000000000043B000-memory.dmp
memory/4936-298-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/5044-281-0x00000000025B0000-0x00000000025B1000-memory.dmp