Malware Analysis Report

2025-06-16 03:51

Sample ID 240130-mfr4hafdan
Target 8231a3d38bc7b4d80468f51b116054c8
SHA256 09d451633478aca81c8f4c945059160bd9f45fc415e013b1e71f5a07bd865127
Tags
snakekeylogger keylogger persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

09d451633478aca81c8f4c945059160bd9f45fc415e013b1e71f5a07bd865127

Threat Level: Known bad

The file 8231a3d38bc7b4d80468f51b116054c8 was found to be: Known bad.

Malicious Activity Summary

snakekeylogger keylogger persistence stealer

Snake Keylogger

Snake Keylogger payload

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-30 10:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-30 10:24

Reported

2024-01-30 10:27

Platform

win7-20231215-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 2036 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

Network

N/A

Files

memory/2036-0-0x0000000074C80000-0x000000007522B000-memory.dmp

memory/2036-1-0x0000000074C80000-0x000000007522B000-memory.dmp

memory/2036-2-0x0000000000230000-0x0000000000270000-memory.dmp

memory/2036-3-0x0000000074C80000-0x000000007522B000-memory.dmp

memory/2036-4-0x0000000000230000-0x0000000000270000-memory.dmp

memory/2036-5-0x0000000000230000-0x0000000000270000-memory.dmp

memory/2036-6-0x0000000074C80000-0x000000007522B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-30 10:24

Reported

2024-01-30 10:27

Platform

win10v2004-20231215-en

Max time kernel

143s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A freegeoip.app N/A N/A
N/A checkip.dyndns.org N/A N/A
N/A freegeoip.app N/A N/A
N/A freegeoip.app N/A N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 700 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
PID 1824 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe
PID 1824 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe
PID 1824 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1824 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1824 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2084 wrote to memory of 4360 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4360 wrote to memory of 2192 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 4360 wrote to memory of 2192 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 8.8.8.8:53 freegeoip.app udp
US 188.114.97.2:443 freegeoip.app tcp
US 8.8.8.8:53 ipbase.com udp
US 104.21.85.189:443 ipbase.com tcp
US 8.8.8.8:53 168.6.122.193.in-addr.arpa udp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 189.85.21.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
DE 193.122.6.168:80 checkip.dyndns.org tcp
US 188.114.97.2:443 freegeoip.app tcp
US 104.21.85.189:443 ipbase.com tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 174.128.246.100:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 100.246.128.174.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/700-0-0x0000000075320000-0x00000000758D1000-memory.dmp

memory/700-1-0x0000000075320000-0x00000000758D1000-memory.dmp

memory/700-2-0x0000000001080000-0x0000000001090000-memory.dmp

memory/700-3-0x0000000075320000-0x00000000758D1000-memory.dmp

memory/700-4-0x0000000001080000-0x0000000001090000-memory.dmp

memory/700-5-0x0000000001080000-0x0000000001090000-memory.dmp

memory/1824-6-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/1824-8-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/1824-9-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/700-10-0x0000000075320000-0x00000000758D1000-memory.dmp

memory/1824-12-0x0000000002A30000-0x0000000002A31000-memory.dmp

memory/1824-11-0x0000000000400000-0x00000000004E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe

MD5 3a5c58c1a52727682465d7925559d21a
SHA1 f68665ef6139c41f5767b597924bc6bca3e2796a
SHA256 a4a844ffd175602400f333741bc0f3582030eaebb90a19f841c855d539bd2e67
SHA512 2f0632dcd10c9424b19678168ff97c2eef959dd31789abbe80c3ed65691dd77037789146656b869fc161c8b8e7682d1f78bd0085a41f2f71e6b1399d47dffee9

C:\ProgramData\Synaptics\Synaptics.exe

MD5 8231a3d38bc7b4d80468f51b116054c8
SHA1 3e8a9a6daf2aee6fd2c23cade11f9e60bab26e3a
SHA256 09d451633478aca81c8f4c945059160bd9f45fc415e013b1e71f5a07bd865127
SHA512 655711c12025172079ea0b07b0c3177004d56d378d1148e5ac6e0c569a46a38958a530b0a26214fa840248df06d98f9c3872e08245e85bd095f7a782d3fdd8a3

memory/3904-78-0x0000000000E10000-0x0000000000E34000-memory.dmp

memory/1824-136-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/3904-138-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

memory/2084-139-0x0000000001A00000-0x0000000001A10000-memory.dmp

memory/2084-140-0x0000000073580000-0x0000000073B31000-memory.dmp

memory/2084-141-0x0000000073580000-0x0000000073B31000-memory.dmp

memory/3904-142-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

memory/3904-143-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

memory/2084-144-0x0000000001A00000-0x0000000001A10000-memory.dmp

memory/2084-145-0x0000000073580000-0x0000000073B31000-memory.dmp

memory/2084-146-0x0000000001A00000-0x0000000001A10000-memory.dmp

memory/4360-151-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/4360-152-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/4360-153-0x0000000001070000-0x0000000001071000-memory.dmp

memory/2084-156-0x0000000073580000-0x0000000073B31000-memory.dmp

memory/4360-215-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/4360-216-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/2192-217-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

memory/2192-218-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

memory/2192-219-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

memory/4360-220-0x0000000000400000-0x00000000004E0000-memory.dmp

memory/4360-221-0x0000000001070000-0x0000000001071000-memory.dmp