Analysis
- max time kernel
209s - max time network
302s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
11/03/2024, 04:49
General
- Target bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7.exe
- Size 169KB
- Sample240311-ff72dscf7t
- SHA256 bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
amadey
-
4.12
-
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
-
lumma
-
https://resergvearyinitiani.shop/api
-
https://associationokeo.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- DcRat 6 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 4 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Pitou 2 IoCs
Pitou.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Blocklisted process makes network request 4 IoCs
- Contacts a large (742) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 23 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 10 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7.exe"C:\Users\Admin\AppData\Local\Temp\bec442ea6db20ffc73c69220ae12fcfca036bda5667c0aedec4560998d89c7f7.exe"1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F388.exeC:\Users\Admin\AppData\Local\Temp\F388.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\FC62.exeC:\Users\Admin\AppData\Local\Temp\FC62.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6D3.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6D3.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1C02.exeC:\Users\Admin\AppData\Local\Temp\1C02.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1C02.exeC:\Users\Admin\AppData\Local\Temp\1C02.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\281913400149_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN InstallSetup8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe"3⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\syncUpd.exeC:\Users\Admin\AppData\Local\Temp\syncUpd.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "5⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12516⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F6⤵
- DcRat
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000929001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000929001\file300un.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000930001\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000930001\InstallSetup8.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7C24.exeC:\Users\Admin\AppData\Local\Temp\7C24.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3mk.0.exe"C:\Users\Admin\AppData\Local\Temp\u3mk.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\u3mk.1.exe"C:\Users\Admin\AppData\Local\Temp\u3mk.1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- DcRat
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\94BE.exeC:\Users\Admin\AppData\Local\Temp\94BE.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LD6T2.tmp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\is-LD6T2.tmp\94BE.tmp" /SL5="$B01D8,1714247,56832,C:\Users\Admin\AppData\Local\Temp\94BE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\C8CF.exeC:\Users\Admin\AppData\Local\Temp\C8CF.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exeC:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exeC:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44B2.exeC:\Users\Admin\AppData\Local\Temp\44B2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exeC:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exeC:\Users\Admin\AppData\Local\Temp\1000928001\InstallSetup8.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
explorgu.exe
explorgu.exe
explorgu.exe
InstallSetup8.exe
InstallSetup8.exe
InstallSetup8.exe
4767d2e713f2021e8fe856e3ea638b58.exe
4767d2e713f2021e8fe856e3ea638b58.exe
4767d2e713f2021e8fe856e3ea638b58.exe
4767d2e713f2021e8fe856e3ea638b58.exe
file300un.exe
InstallSetup8.exe
InstallSetup8.exe
InstallSetup8.exe
InstallSetup8.exe
InstallSetup8.exe
1C02.exe
1C02.exe
1C02.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
44B2.exe
44B2.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
6D3.dll
7C24.exe
7C24.exe
94BE.exe
94BE.exe
BroomSetup.exe
BroomSetup.exe
C8CF.exe
C8CF.exe
F388.exe
F388.exe
FC62.exe
FC62.exe
InstallSetup_four.exe
InstallSetup_four.exe
__PSScriptPolicyTest_svx2h4hb.4nu.ps1
94BE.tmp
94BE.tmp
u3mk.0.exe
u3mk.1.exe
clip64.dll
cred64.dll
cred64.dll
Task.bat
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
csrss.exe
csrss.exe
mozglue.dll
nss3.dll
6D3.dll
6D3.dll
_iscrypt.dll
INetC.dll
cred64.dll
cred64.dll
memory/532-214-0x0000000000400000-0x0000000000930000-memory.dmp
memory/532-221-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/824-189-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-260-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-82-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/824-84-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/824-81-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/824-80-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/824-194-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-85-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/824-79-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/824-131-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-83-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
memory/824-78-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-199-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-77-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/824-95-0x00000000002F0000-0x0000000000794000-memory.dmp
memory/1536-45-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/1536-75-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/1536-48-0x0000000004700000-0x000000000482B000-memory.dmp
memory/1536-52-0x0000000004830000-0x000000000493F000-memory.dmp
memory/1536-49-0x0000000004830000-0x000000000493F000-memory.dmp
memory/1536-46-0x00000000003F0000-0x00000000003F6000-memory.dmp
memory/2012-222-0x0000000002A40000-0x0000000002E44000-memory.dmp
memory/2012-144-0x0000000002A40000-0x0000000002E44000-memory.dmp
memory/2012-146-0x0000000002E50000-0x000000000373B000-memory.dmp
memory/2012-232-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2012-158-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2012-192-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2244-100-0x00000000002F0000-0x0000000000762000-memory.dmp
memory/2244-129-0x0000000073060000-0x000000007374E000-memory.dmp
memory/2244-106-0x0000000073060000-0x000000007374E000-memory.dmp
memory/2592-87-0x0000000003010000-0x000000000311F000-memory.dmp
memory/2592-59-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2592-62-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2592-66-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2592-86-0x0000000002EE0000-0x000000000300B000-memory.dmp
memory/2592-65-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2592-67-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2592-71-0x00000000008E0000-0x00000000008E6000-memory.dmp
memory/2592-68-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2592-90-0x0000000003010000-0x000000000311F000-memory.dmp
memory/2636-225-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/2636-224-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/2636-219-0x00000000008F0000-0x0000000000D94000-memory.dmp
memory/2636-236-0x00000000008F0000-0x0000000000D94000-memory.dmp
memory/2636-230-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/2636-227-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/2636-223-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/2636-226-0x0000000004990000-0x0000000004991000-memory.dmp
memory/2876-60-0x0000000002300000-0x00000000024C1000-memory.dmp
memory/2876-63-0x00000000024D0000-0x0000000002687000-memory.dmp
memory/3408-4-0x00000000009C0000-0x00000000009D6000-memory.dmp
memory/4432-3-0x0000000000400000-0x0000000000474000-memory.dmp
memory/4432-2-0x00000000001F0000-0x00000000001FB000-memory.dmp
memory/4432-1-0x00000000006D0000-0x00000000007D0000-memory.dmp
memory/4432-5-0x0000000000400000-0x0000000000474000-memory.dmp
memory/4600-205-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/4600-169-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/4612-206-0x0000000000950000-0x0000000000A50000-memory.dmp
memory/4612-207-0x00000000008B0000-0x00000000008D7000-memory.dmp
memory/4612-262-0x0000000000400000-0x000000000063B000-memory.dmp
memory/4612-209-0x0000000000400000-0x000000000063B000-memory.dmp
memory/4680-17-0x0000000001010000-0x00000000014B4000-memory.dmp
memory/4680-23-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/4680-15-0x0000000001010000-0x00000000014B4000-memory.dmp
memory/4680-16-0x0000000077D94000-0x0000000077D95000-memory.dmp
memory/4680-24-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/4680-22-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/4680-21-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/4680-20-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/4680-19-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/4680-18-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/4680-27-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/4680-26-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/4680-32-0x0000000001010000-0x00000000014B4000-memory.dmp
memory/4700-190-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4700-138-0x0000000001FB0000-0x0000000002017000-memory.dmp
memory/4700-140-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4700-213-0x0000000000400000-0x0000000000469000-memory.dmp
memory/4700-134-0x0000000000500000-0x0000000000600000-memory.dmp
memory/4828-137-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4828-195-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4828-143-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4920-76-0x0000000001D10000-0x0000000001E10000-memory.dmp
memory/4920-38-0x0000000001D10000-0x0000000001E10000-memory.dmp
memory/4920-58-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/4920-41-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/4920-39-0x0000000001C20000-0x0000000001C8B000-memory.dmp
memory/5072-196-0x00007FFF21C50000-0x00007FFF2263C000-memory.dmp
memory/5072-197-0x0000015608FD0000-0x0000015608FE0000-memory.dmp
memory/5072-198-0x0000015608FD0000-0x0000015608FE0000-memory.dmp
memory/5072-202-0x0000015609100000-0x0000015609122000-memory.dmp