a26595e04bbad90731a04c1195c34d92.exe

General
Target

a26595e04bbad90731a04c1195c34d92.exe

Filesize

1MB

Completed

29-09-2021 00:08

Score
10/10
MD5

a26595e04bbad90731a04c1195c34d92

SHA1

0b295fa12e6bd596ba0071a58370966c6a4551c3

SHA256

c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

Malware Config

Extracted

Family amadey
Version 2.61
C2

185.215.113.33/hBF6ds2D/index.php

Signatures 8

Filter: none

Discovery
Persistence
  • Amadey

    Description

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • suricata: ET MALWARE Amadey CnC Check-In

    Description

    suricata: ET MALWARE Amadey CnC Check-In

    Tags

  • Executes dropped EXE
    sqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    pidprocess
    1524sqtvvs.exe
    464sqtvvs.exe
    1844sqtvvs.exe
    1068sqtvvs.exe
    1516sqtvvs.exe
    1528sqtvvs.exe
    1764sqtvvs.exe
    820sqtvvs.exe
  • Loads dropped DLL
    a26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    pidprocess
    1824a26595e04bbad90731a04c1195c34d92.exe
    1824a26595e04bbad90731a04c1195c34d92.exe
    1524sqtvvs.exe
    1844sqtvvs.exe
    1516sqtvvs.exe
    1764sqtvvs.exe
  • Suspicious use of SetThreadContext
    a26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1828 set thread context of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1524 set thread context of 4641524sqtvvs.exesqtvvs.exe
    PID 1844 set thread context of 10681844sqtvvs.exesqtvvs.exe
    PID 1516 set thread context of 15281516sqtvvs.exesqtvvs.exe
    PID 1764 set thread context of 8201764sqtvvs.exesqtvvs.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1852schtasks.exe
  • Suspicious use of WriteProcessMemory
    a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exesqtvvs.exesqtvvs.execmd.exetaskeng.exesqtvvs.exesqtvvs.exesqtvvs.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1828 wrote to memory of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1828 wrote to memory of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1828 wrote to memory of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1828 wrote to memory of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1828 wrote to memory of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1828 wrote to memory of 18241828a26595e04bbad90731a04c1195c34d92.exea26595e04bbad90731a04c1195c34d92.exe
    PID 1824 wrote to memory of 15241824a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 1824 wrote to memory of 15241824a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 1824 wrote to memory of 15241824a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 1824 wrote to memory of 15241824a26595e04bbad90731a04c1195c34d92.exesqtvvs.exe
    PID 1524 wrote to memory of 4641524sqtvvs.exesqtvvs.exe
    PID 1524 wrote to memory of 4641524sqtvvs.exesqtvvs.exe
    PID 1524 wrote to memory of 4641524sqtvvs.exesqtvvs.exe
    PID 1524 wrote to memory of 4641524sqtvvs.exesqtvvs.exe
    PID 1524 wrote to memory of 4641524sqtvvs.exesqtvvs.exe
    PID 1524 wrote to memory of 4641524sqtvvs.exesqtvvs.exe
    PID 464 wrote to memory of 1504464sqtvvs.execmd.exe
    PID 464 wrote to memory of 1504464sqtvvs.execmd.exe
    PID 464 wrote to memory of 1504464sqtvvs.execmd.exe
    PID 464 wrote to memory of 1504464sqtvvs.execmd.exe
    PID 464 wrote to memory of 1852464sqtvvs.exeschtasks.exe
    PID 464 wrote to memory of 1852464sqtvvs.exeschtasks.exe
    PID 464 wrote to memory of 1852464sqtvvs.exeschtasks.exe
    PID 464 wrote to memory of 1852464sqtvvs.exeschtasks.exe
    PID 1504 wrote to memory of 18601504cmd.exereg.exe
    PID 1504 wrote to memory of 18601504cmd.exereg.exe
    PID 1504 wrote to memory of 18601504cmd.exereg.exe
    PID 1504 wrote to memory of 18601504cmd.exereg.exe
    PID 784 wrote to memory of 1844784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1844784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1844784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1844784taskeng.exesqtvvs.exe
    PID 1844 wrote to memory of 10681844sqtvvs.exesqtvvs.exe
    PID 1844 wrote to memory of 10681844sqtvvs.exesqtvvs.exe
    PID 1844 wrote to memory of 10681844sqtvvs.exesqtvvs.exe
    PID 1844 wrote to memory of 10681844sqtvvs.exesqtvvs.exe
    PID 1844 wrote to memory of 10681844sqtvvs.exesqtvvs.exe
    PID 1844 wrote to memory of 10681844sqtvvs.exesqtvvs.exe
    PID 784 wrote to memory of 1516784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1516784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1516784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1516784taskeng.exesqtvvs.exe
    PID 1516 wrote to memory of 15281516sqtvvs.exesqtvvs.exe
    PID 1516 wrote to memory of 15281516sqtvvs.exesqtvvs.exe
    PID 1516 wrote to memory of 15281516sqtvvs.exesqtvvs.exe
    PID 1516 wrote to memory of 15281516sqtvvs.exesqtvvs.exe
    PID 1516 wrote to memory of 15281516sqtvvs.exesqtvvs.exe
    PID 1516 wrote to memory of 15281516sqtvvs.exesqtvvs.exe
    PID 784 wrote to memory of 1764784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1764784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1764784taskeng.exesqtvvs.exe
    PID 784 wrote to memory of 1764784taskeng.exesqtvvs.exe
    PID 1764 wrote to memory of 8201764sqtvvs.exesqtvvs.exe
    PID 1764 wrote to memory of 8201764sqtvvs.exesqtvvs.exe
    PID 1764 wrote to memory of 8201764sqtvvs.exesqtvvs.exe
    PID 1764 wrote to memory of 8201764sqtvvs.exesqtvvs.exe
    PID 1764 wrote to memory of 8201764sqtvvs.exesqtvvs.exe
    PID 1764 wrote to memory of 8201764sqtvvs.exesqtvvs.exe
Processes 14
  • C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe
    "C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe
      "C:\Users\Admin\AppData\Local\Temp\a26595e04bbad90731a04c1195c34d92.exe"
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
          "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe"
          Executes dropped EXE
          Suspicious use of WriteProcessMemory
          PID:464
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\
            Suspicious use of WriteProcessMemory
            PID:1504
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\7ac441486f\
              PID:1860
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe" /F
            Creates scheduled task(s)
            PID:1852
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {511B91C2-23E9-435C-BD3C-517743D021CA} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
    Suspicious use of WriteProcessMemory
    PID:784
    • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        Executes dropped EXE
        PID:1068
    • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        Executes dropped EXE
        PID:1528
    • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe
        Executes dropped EXE
        PID:820
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\15212455352368107708

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\15212455352368107708

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\15212455352368107708

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\15212455352368107708

                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • C:\Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • \Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • \Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • \Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • \Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • \Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • \Users\Admin\AppData\Local\Temp\7ac441486f\sqtvvs.exe

                        MD5

                        a26595e04bbad90731a04c1195c34d92

                        SHA1

                        0b295fa12e6bd596ba0071a58370966c6a4551c3

                        SHA256

                        c5e41abe14036a3331b4bd9e3bb24be2424439a8030b8dfbe1a61a3da6482573

                        SHA512

                        ad8682d0772bc0668fde3d7818a180b64da892e9c687332a960efa8c7ed5bdb12b5a1286d833c145c667d25373a7001ae320d24034c1f1fd089a1e1a273ff934

                      • memory/464-71-0x00000000004105EF-mapping.dmp

                      • memory/464-77-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/820-99-0x00000000004105EF-mapping.dmp

                      • memory/1068-83-0x00000000004105EF-mapping.dmp

                      • memory/1504-75-0x0000000000000000-mapping.dmp

                      • memory/1516-87-0x0000000000000000-mapping.dmp

                      • memory/1524-66-0x0000000000000000-mapping.dmp

                      • memory/1528-91-0x00000000004105EF-mapping.dmp

                      • memory/1764-95-0x0000000000000000-mapping.dmp

                      • memory/1824-60-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/1824-63-0x0000000000400000-0x0000000000439000-memory.dmp

                      • memory/1824-62-0x0000000075801000-0x0000000075803000-memory.dmp

                      • memory/1824-61-0x00000000004105EF-mapping.dmp

                      • memory/1844-79-0x0000000000000000-mapping.dmp

                      • memory/1852-76-0x0000000000000000-mapping.dmp

                      • memory/1860-78-0x0000000000000000-mapping.dmp