Analysis
- max time kernel
179s - max time network
304s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
11/03/2024, 04:49
General
- Target bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7.exe
- Size 169KB
- Sample240311-ff72dscf7t
- SHA256 bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 1 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 4 IoCs
- Pitou 2 IoCs
Pitou.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 16 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 29 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7.exe"C:\Users\Admin\AppData\Local\Temp\bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\958B.exeC:\Users\Admin\AppData\Local\Temp\958B.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\A3A0.exeC:\Users\Admin\AppData\Local\Temp\A3A0.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14CA.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\14CA.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\8430.exeC:\Users\Admin\AppData\Local\Temp\8430.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8430.exeC:\Users\Admin\AppData\Local\Temp\8430.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\D3F6.exeC:\Users\Admin\AppData\Local\Temp\D3F6.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1rs.0.exe"C:\Users\Admin\AppData\Local\Temp\u1rs.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\u1rs.1.exe"C:\Users\Admin\AppData\Local\Temp\u1rs.1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DDA7.exeC:\Users\Admin\AppData\Local\Temp\DDA7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CA85D.tmp\DDA7.tmp"C:\Users\Admin\AppData\Local\Temp\is-CA85D.tmp\DDA7.tmp" /SL5="$8011C,1714247,56832,C:\Users\Admin\AppData\Local\Temp\DDA7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240311045231.log C:\Windows\Logs\CBS\CbsPersist_20240311045231.cab1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\1626.exeC:\Users\Admin\AppData\Local\Temp\1626.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\309405411416_Desktop.zip' -CompressionLevel Optimal5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2605⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_3816_133546064383890000\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\24D6.exeC:\Users\Admin\AppData\Local\Temp\24D6.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\D8F9.exeC:\Users\Admin\AppData\Local\Temp\D8F9.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 1242⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
explorgu.exe
osminog.exe
goldprime123.exe
judith.exe
alex12341.exe
14CA.dll
1626.exe
24D6.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
8430.exe
8430.exe
958B.exe
A3A0.exe
CabC860.tmp
D3F6.exe
D3F6.exe
DDA7.exe
TarCB35.tmp
DDA7.tmp
ntkrnlmp.exe
u1rs.0.exe
u1rs.1.exe
u1rs.1.exe
clip64.dll
cred64.dll
cred64.dll
Task.bat
explorgu.job
14CA.dll
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
8430.exe
InstallSetup_four.exe
_iscrypt.dll
_shfoldr.dll
u1rs.0.exe
u1rs.0.exe
u1rs.1.exe
u1rs.1.exe
cred64.dll
csrss.exe
memory/320-147-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/320-205-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/916-245-0x0000000000DC0000-0x0000000001264000-memory.dmp
memory/1156-123-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1156-137-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1208-4-0x0000000002A00000-0x0000000002A16000-memory.dmp
memory/1516-174-0x0000000073970000-0x000000007405E000-memory.dmp
memory/1516-114-0x0000000000330000-0x00000000007A2000-memory.dmp
memory/1516-115-0x0000000073970000-0x000000007405E000-memory.dmp
memory/1548-78-0x0000000001F40000-0x00000000020F8000-memory.dmp
memory/1548-79-0x0000000001F40000-0x00000000020F8000-memory.dmp
memory/1548-80-0x0000000002100000-0x00000000022B7000-memory.dmp
memory/1592-207-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1592-184-0x0000000002A90000-0x000000000337B000-memory.dmp
memory/1592-183-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1592-182-0x0000000002690000-0x0000000002A88000-memory.dmp
memory/1592-181-0x0000000002690000-0x0000000002A88000-memory.dmp
memory/1592-231-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2180-1-0x00000000008E0000-0x00000000009E0000-memory.dmp
memory/2180-5-0x0000000000400000-0x0000000000474000-memory.dmp
memory/2180-3-0x0000000000400000-0x0000000000474000-memory.dmp
memory/2180-2-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2196-64-0x0000000002420000-0x000000000252F000-memory.dmp
memory/2196-68-0x0000000002420000-0x000000000252F000-memory.dmp
memory/2196-59-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/2196-58-0x0000000000100000-0x0000000000106000-memory.dmp
memory/2196-63-0x00000000022F0000-0x000000000241B000-memory.dmp
memory/2196-67-0x0000000002420000-0x000000000252F000-memory.dmp
memory/2288-25-0x0000000000820000-0x0000000000821000-memory.dmp
memory/2288-39-0x0000000000F30000-0x00000000013D4000-memory.dmp
memory/2288-29-0x0000000000420000-0x0000000000421000-memory.dmp
memory/2288-28-0x00000000004F0000-0x00000000004F1000-memory.dmp
memory/2288-27-0x0000000000490000-0x0000000000491000-memory.dmp
memory/2288-34-0x0000000002C20000-0x0000000002C21000-memory.dmp
memory/2288-22-0x0000000000840000-0x0000000000841000-memory.dmp
memory/2288-33-0x0000000000430000-0x0000000000431000-memory.dmp
memory/2288-26-0x0000000000830000-0x0000000000831000-memory.dmp
memory/2288-18-0x0000000076F50000-0x0000000076F52000-memory.dmp
memory/2288-24-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/2288-23-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2288-30-0x0000000000540000-0x0000000000541000-memory.dmp
memory/2288-31-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/2288-20-0x00000000009F0000-0x00000000009F2000-memory.dmp
memory/2288-21-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/2288-17-0x0000000000F30000-0x00000000013D4000-memory.dmp
memory/2288-19-0x0000000000F30000-0x00000000013D4000-memory.dmp
memory/2296-178-0x00000000002F0000-0x00000000003F0000-memory.dmp
memory/2296-206-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2296-270-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2296-180-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2296-179-0x00000000004E0000-0x0000000000547000-memory.dmp
memory/2356-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2356-203-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-150-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-108-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-102-0x0000000002CB0000-0x0000000002DBF000-memory.dmp
memory/2356-101-0x0000000002CB0000-0x0000000002DBF000-memory.dmp
memory/2356-98-0x0000000002CB0000-0x0000000002DBF000-memory.dmp
memory/2356-97-0x0000000002B80000-0x0000000002CAB000-memory.dmp
memory/2356-94-0x0000000000280000-0x0000000000286000-memory.dmp
memory/2356-92-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-177-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-91-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-90-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-88-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-89-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-135-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2356-85-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2416-48-0x0000000000220000-0x000000000028B000-memory.dmp
memory/2416-54-0x0000000000220000-0x000000000028B000-memory.dmp
memory/2416-49-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/2416-50-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/2416-53-0x0000000001B80000-0x0000000001C80000-memory.dmp
memory/2416-51-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/2416-47-0x0000000001B80000-0x0000000001C80000-memory.dmp
memory/2456-269-0x0000000002640000-0x0000000002A38000-memory.dmp
memory/2640-226-0x00000000022D0000-0x00000000022D1000-memory.dmp
memory/2640-220-0x0000000002400000-0x0000000002401000-memory.dmp
memory/2640-228-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/2640-241-0x0000000002790000-0x0000000002791000-memory.dmp
memory/2640-234-0x0000000000970000-0x0000000000971000-memory.dmp
memory/2640-240-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/2640-225-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/2640-237-0x00000000009E0000-0x0000000000E84000-memory.dmp
memory/2640-242-0x00000000053D0000-0x0000000005874000-memory.dmp
memory/2640-229-0x0000000000920000-0x0000000000921000-memory.dmp
memory/2640-224-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2640-223-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/2640-222-0x0000000002740000-0x0000000002741000-memory.dmp
memory/2640-221-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/2640-218-0x00000000009E0000-0x0000000000E84000-memory.dmp
memory/2640-219-0x00000000022E0000-0x00000000022E2000-memory.dmp
memory/2640-227-0x0000000002670000-0x0000000002671000-memory.dmp
memory/2792-217-0x0000000000400000-0x000000000063B000-memory.dmp
memory/2792-216-0x0000000000220000-0x0000000000247000-memory.dmp
memory/2792-215-0x00000000007F0000-0x00000000008F0000-memory.dmp
memory/2792-322-0x0000000061E00000-0x0000000061EF3000-memory.dmp