Malware Analysis Report

2024-11-15 08:09

Sample ID 221004-c8v1rahegk
Target e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a
SHA256 e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a

Threat Level: Known bad

The file e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Uses the VBS compiler for execution

Checks computer location settings

Suspicious use of SetThreadContext

AutoIT Executable

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-04 02:45

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-04 02:45

Reported

2022-10-04 11:40

Platform

win7-20220812-en

Max time kernel

150s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"

Signatures

Imminent RAT

trojan spyware imminent

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1256 set thread context of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\ahk_auto_file\ C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\ahk_auto_file\shell\Read C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\ahk_auto_file\shell\Read\command C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\ahk_auto_file C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.ahk C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.ahk\ = "ahk_auto_file" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\ahk_auto_file\shell C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\ahk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\SysWOW64\rundll32.exe
PID 1692 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 1692 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 1692 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 1692 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 1256 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1256 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1256 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1256 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1256 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1256 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1272 wrote to memory of 112 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1272 wrote to memory of 112 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1272 wrote to memory of 112 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
PID 1272 wrote to memory of 112 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe

"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Tempauto jump.ahk

C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe

"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\732125" "C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Tempauto jump.ahk"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sheik.chickenkiller.com udp

Files

memory/1692-54-0x0000000075661000-0x0000000075663000-memory.dmp

memory/1272-55-0x0000000000000000-mapping.dmp

memory/1256-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\732125

MD5 31a67a9a9b3add7bc836e3348191b2f8
SHA1 40d9198c3be878b55bc4e1404fa2eca853282c31
SHA256 46453e6da45258c2c06fecc44508cb5dab64efe57a345189f60153200d4ed8b7
SHA512 4d4100f03d68e872d6a109265a90ec4b9795978c5895c4a8aa851ea6f482973740b03702525110b676defc0bc09bb4b29911396ae94d0280e459bee4b45f810f

C:\Users\Admin\AppData\Local\Temp\incl1

MD5 cf37a7b7d39af92bc45571433e1df301
SHA1 cce6c2a3c32c5ff7bdad549422cdddf5deccfd13
SHA256 d29bb4c5f8b8b32149e319f5efecb755c3b8f5465f1f33c30bbbc8774e870937
SHA512 8b4ebf92723d8b8b4c2d2928ced1c44328eb05429d7db8a7a8b282c4519cf6a168097bbdf6cdb12e1ddb65a87410cbdc7ef54d77140f4b28afc939e606840e0c

C:\Users\Admin\AppData\Local\Temp\incl2

MD5 6cb65cda337af8c947fb213ebf5370cb
SHA1 78dda4b942251aba07465d2778da59a0068da92f
SHA256 390cefc7566dde54ea95718d83235aa83fd02090420b679bae5ec31847e565a6
SHA512 5ac12ca2f58bc2b3f9cb18a199b4d37e0b73ed739b12b9823d0c65a3e7aa564808518014bd66de3e182907cb1349e014c3303c30c2a5c5f85cb69fdc541122b2

memory/2036-62-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2036-64-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2036-65-0x00000000000CC5EE-mapping.dmp

memory/2036-67-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2036-69-0x0000000000080000-0x00000000000D2000-memory.dmp

memory/2036-70-0x00000000002C0000-0x00000000002D0000-memory.dmp

memory/2036-71-0x0000000004580000-0x0000000004628000-memory.dmp

memory/2036-72-0x0000000000460000-0x0000000000490000-memory.dmp

memory/2036-73-0x00000000005A0000-0x00000000005AE000-memory.dmp

memory/2036-75-0x0000000000620000-0x0000000000636000-memory.dmp

memory/112-76-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Tempauto jump.ahk

MD5 5b000d5b5e2f07dc0d3b03c1b041c6d0
SHA1 1e79bdc98b57be8c72e199863e90c02e3bfd1bc3
SHA256 ddd52a4136145708f8399349127492ec3b2692a2acd4c6a0d02372e92a990099
SHA512 19e5ebe1182e70a5e4a2ff313cc222654147acef6063617d692bb7b7011d97ddaef54171d7b9793744bb928e262019a29770dd509d35ddfca1f5a066b11c6fae

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-04 02:45

Reported

2022-10-04 11:41

Platform

win10v2004-20220812-en

Max time kernel

148s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"

Signatures

Imminent RAT

trojan spyware imminent

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2388 set thread context of 1156 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1664 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 1664 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 1664 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe
PID 2388 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2388 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2388 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2388 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2388 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe

"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe

"C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\791913" "C:\Users\Admin\AppData\Local\Temp\e77485234f6292a030dfeac5f46c29c116464670265cea35852e11f6f9bd509a.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp
US 8.8.8.8:53 sheik.chickenkiller.com udp

Files

memory/2388-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\791913

MD5 31a67a9a9b3add7bc836e3348191b2f8
SHA1 40d9198c3be878b55bc4e1404fa2eca853282c31
SHA256 46453e6da45258c2c06fecc44508cb5dab64efe57a345189f60153200d4ed8b7
SHA512 4d4100f03d68e872d6a109265a90ec4b9795978c5895c4a8aa851ea6f482973740b03702525110b676defc0bc09bb4b29911396ae94d0280e459bee4b45f810f

C:\Users\Admin\AppData\Local\Temp\incl2

MD5 6cb65cda337af8c947fb213ebf5370cb
SHA1 78dda4b942251aba07465d2778da59a0068da92f
SHA256 390cefc7566dde54ea95718d83235aa83fd02090420b679bae5ec31847e565a6
SHA512 5ac12ca2f58bc2b3f9cb18a199b4d37e0b73ed739b12b9823d0c65a3e7aa564808518014bd66de3e182907cb1349e014c3303c30c2a5c5f85cb69fdc541122b2

C:\Users\Admin\AppData\Local\Temp\incl1

MD5 cf37a7b7d39af92bc45571433e1df301
SHA1 cce6c2a3c32c5ff7bdad549422cdddf5deccfd13
SHA256 d29bb4c5f8b8b32149e319f5efecb755c3b8f5465f1f33c30bbbc8774e870937
SHA512 8b4ebf92723d8b8b4c2d2928ced1c44328eb05429d7db8a7a8b282c4519cf6a168097bbdf6cdb12e1ddb65a87410cbdc7ef54d77140f4b28afc939e606840e0c

memory/1156-136-0x0000000000000000-mapping.dmp

memory/1156-137-0x0000000000690000-0x00000000006E2000-memory.dmp

memory/1156-138-0x0000000005140000-0x00000000051DC000-memory.dmp

memory/1156-139-0x0000000006C80000-0x0000000007224000-memory.dmp