Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
18/01/2024, 16:11
General
- Target file.exe
- Size 241KB
- Sample240118-tmx2nadaem
- SHA256 b52028609b92de2f7a3621621f2d3b3de11f48c16b1d612ad2efebb2af4af2a2
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
stealc
-
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Extracted
-
smokeloader
-
pub1
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect Socks5Systemz Payload 2 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 7 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Socks5Systemz
Socks5Systemz is a botnet written in C++.
- Stealc
Stealc is an infostealer written in C++.
- Windows security bypass 2 TTPs 7 IoCs
- Modifies boot configuration data using bcdedit 14 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
- Deletes itself 1 IoCs
- Executes dropped EXE 21 IoCs
- Loads dropped DLL 30 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 7 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of SetThreadContext 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 5 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 11 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6C89.exeC:\Users\Admin\AppData\Local\Temp\6C89.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\713B.exeC:\Users\Admin\AppData\Local\Temp\713B.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\713B.exeC:\Users\Admin\AppData\Local\Temp\713B.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\A076.exeC:\Users\Admin\AppData\Local\Temp\A076.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\BB76.dll1⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\BB76.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C3DF.exeC:\Users\Admin\AppData\Local\Temp\C3DF.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nseE736.tmpC:\Users\Admin\AppData\Local\Temp\nseE736.tmp3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nseE736.tmp" & del "C:\ProgramData\*.dll"" & exit4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 06⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 16⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 06⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:6⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CB7E.exeC:\Users\Admin\AppData\Local\Temp\CB7E.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-OV83U.tmp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\is-OV83U.tmp\CB7E.tmp" /SL5="$20194,4003424,54272,C:\Users\Admin\AppData\Local\Temp\CB7E.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "EUCR1182"3⤵
-
-
C:\Users\Admin\AppData\Local\EU Audio Converter\EUConverterRipper.exe"C:\Users\Admin\AppData\Local\EU Audio Converter\EUConverterRipper.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\EU Audio Converter\EUConverterRipper.exe"C:\Users\Admin\AppData\Local\EU Audio Converter\EUConverterRipper.exe" -s3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\EB6.exeC:\Users\Admin\AppData\Local\Temp\EB6.exe1⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240118161221.log C:\Windows\Logs\CBS\CbsPersist_20240118161221.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\timeout.exetimeout /t 51⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1374023690359708485-1783511310-1011143451-2017126076-761008241-1065154826-1871392399"1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
3Disable or Modify Tools
2Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
EUConverterRipper.exe
EUConverterRipper.exe
EUConverterRipper.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
6C89.exe
713B.exe
713B.exe
713B.exe
713B.exe
A076.exe
A076.exe
BB76.dll
BroomSetup.exe
C3DF.exe
C3DF.exe
CB7E.exe
CB7E.exe
Cab4B64.tmp
EB6.exe
EB6.exe
InstallSetup9.exe
InstallSetup9.exe
download.error
download.error
Tar4C13.tmp
dsefix.exe
injector.exe
patch.exe
CB7E.tmp
nseE736.tmp
nseE736.tmp
nseE736.tmp
ntkrnlmp.exe
osloader.exe
Task.bat
csrss.exe
csrss.exe
windefender.exe
windefender.exe
windefender.exe
cb7e.tmp
mozglue.dll
nss3.dll
EUConverterRipper.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
713B.exe
BB76.dll
BroomSetup.exe
InstallSetup9.exe
injector.exe
patch.exe
dbghelp.dll
_iscrypt.dll
_shfoldr.dll
CB7E.tmp
nseE736.tmp
nseE736.tmp
INetC.dll
ntkrnlmp.exe
ntkrnlmp.exe
ntkrnlmp.exe
osloader.exe
osloader.exe
osloader.exe
symsrv.dll
csrss.exe
memory/704-159-0x0000000002710000-0x0000000002829000-memory.dmp
memory/704-118-0x00000000000C0000-0x00000000000C6000-memory.dmp
memory/704-114-0x0000000010000000-0x000000001029D000-memory.dmp
memory/704-160-0x0000000002830000-0x000000000292D000-memory.dmp
memory/704-170-0x0000000002830000-0x000000000292D000-memory.dmp
memory/768-591-0x00000000006B0000-0x00000000007B0000-memory.dmp
memory/768-592-0x0000000000400000-0x000000000062E000-memory.dmp
memory/768-489-0x00000000006B0000-0x00000000007B0000-memory.dmp
memory/768-494-0x0000000000400000-0x000000000062E000-memory.dmp
memory/768-363-0x00000000006B0000-0x00000000007B0000-memory.dmp
memory/768-367-0x0000000000400000-0x000000000062E000-memory.dmp
memory/768-366-0x00000000002B0000-0x00000000002CC000-memory.dmp
memory/924-99-0x0000000000160000-0x0000000000161000-memory.dmp
memory/924-87-0x0000000000140000-0x0000000000141000-memory.dmp
memory/924-97-0x00000000771B0000-0x00000000771B1000-memory.dmp
memory/924-101-0x0000000000160000-0x0000000000161000-memory.dmp
memory/924-69-0x0000000000090000-0x0000000000091000-memory.dmp
memory/924-71-0x0000000000DC0000-0x00000000016EA000-memory.dmp
memory/924-92-0x0000000000150000-0x0000000000151000-memory.dmp
memory/924-94-0x0000000000150000-0x0000000000151000-memory.dmp
memory/924-84-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/924-109-0x0000000000DC0000-0x00000000016EA000-memory.dmp
memory/924-82-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/924-77-0x00000000000A0000-0x00000000000A1000-memory.dmp
memory/924-80-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/924-104-0x0000000000170000-0x0000000000171000-memory.dmp
memory/924-79-0x00000000000A0000-0x00000000000A1000-memory.dmp
memory/924-89-0x0000000000140000-0x0000000000141000-memory.dmp
memory/924-106-0x0000000000170000-0x0000000000171000-memory.dmp
memory/924-96-0x0000000000DC0000-0x00000000016EA000-memory.dmp
memory/924-72-0x0000000000090000-0x0000000000091000-memory.dmp
memory/924-74-0x0000000000090000-0x0000000000091000-memory.dmp
memory/924-75-0x00000000000A0000-0x00000000000A1000-memory.dmp
memory/1040-394-0x0000000000400000-0x0000000000440000-memory.dmp
memory/1040-392-0x00000000004F0000-0x00000000005F0000-memory.dmp
memory/1040-393-0x0000000000220000-0x000000000022B000-memory.dmp
memory/1040-401-0x0000000000400000-0x0000000000440000-memory.dmp
memory/1144-4-0x0000000002E90000-0x0000000002EA6000-memory.dmp
memory/1324-505-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1324-504-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1332-319-0x00000000033D0000-0x0000000003769000-memory.dmp
memory/1332-190-0x0000000000240000-0x0000000000241000-memory.dmp
memory/1332-452-0x00000000033D0000-0x0000000003769000-memory.dmp
memory/1500-391-0x0000000000240000-0x0000000000241000-memory.dmp
memory/1500-158-0x0000000000240000-0x0000000000241000-memory.dmp
memory/1640-144-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/1640-126-0x0000000073870000-0x0000000073F5E000-memory.dmp
memory/1640-125-0x0000000000D40000-0x000000000132E000-memory.dmp
memory/1648-321-0x0000000000400000-0x0000000000799000-memory.dmp
memory/1648-345-0x0000000000400000-0x0000000000799000-memory.dmp
memory/1716-168-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1716-409-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2132-717-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2132-691-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2140-3-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2140-1-0x0000000000620000-0x0000000000720000-memory.dmp
memory/2140-5-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2140-2-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2204-677-0x00000000025E0000-0x0000000002682000-memory.dmp
memory/2204-480-0x0000000000400000-0x0000000000799000-memory.dmp
memory/2204-370-0x0000000000400000-0x0000000000799000-memory.dmp
memory/2204-352-0x0000000000400000-0x0000000000799000-memory.dmp
memory/2204-704-0x00000000025E0000-0x0000000002682000-memory.dmp
memory/2248-155-0x00000000026B0000-0x0000000002AA8000-memory.dmp
memory/2248-145-0x00000000026B0000-0x0000000002AA8000-memory.dmp
memory/2248-388-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2248-157-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2248-156-0x0000000002AB0000-0x000000000339B000-memory.dmp
memory/2248-457-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2272-693-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2272-688-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2500-475-0x00000000026A0000-0x0000000002A98000-memory.dmp
memory/2500-630-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2500-479-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2576-124-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2576-37-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-34-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-41-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-40-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-110-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-38-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-117-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-39-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2576-62-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2696-18-0x00000000005A0000-0x00000000006A0000-memory.dmp
memory/2696-20-0x0000000000400000-0x0000000000491000-memory.dmp
memory/2696-61-0x0000000000400000-0x0000000000491000-memory.dmp
memory/2696-68-0x00000000005A0000-0x00000000006A0000-memory.dmp
memory/2696-19-0x0000000000220000-0x000000000028B000-memory.dmp
memory/2832-33-0x00000000021C0000-0x0000000002377000-memory.dmp
memory/2832-27-0x0000000002000000-0x00000000021B8000-memory.dmp
memory/2832-31-0x0000000002000000-0x00000000021B8000-memory.dmp
memory/2892-464-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2892-463-0x00000000027F0000-0x0000000002BE8000-memory.dmp
memory/2892-476-0x0000000000400000-0x0000000000D1C000-memory.dmp