Malware Analysis Report

2025-08-05 19:40

Sample ID 240317-bzv4qabf4v
Target edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771
SHA256 edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771
Tags
urelas trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771

Threat Level: Known bad

The file edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771 was found to be: Known bad.

Malicious Activity Summary

urelas trojan

Urelas family

Urelas

Checks computer location settings

Executes dropped EXE

Deletes itself

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-17 01:35

Signatures

Urelas family

urelas

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-17 01:35

Reported

2024-03-17 01:38

Platform

win10v2004-20240226-en

Max time kernel

160s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe"

Signatures

Urelas

trojan urelas

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\juvot.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\juvot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nihae.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3744 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\juvot.exe
PID 3744 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\juvot.exe
PID 3744 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\juvot.exe
PID 3744 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 4480 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\juvot.exe C:\Users\Admin\AppData\Local\Temp\nihae.exe
PID 4480 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\juvot.exe C:\Users\Admin\AppData\Local\Temp\nihae.exe
PID 4480 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\juvot.exe C:\Users\Admin\AppData\Local\Temp\nihae.exe

Processes

C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe

"C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\juvot.exe

"C:\Users\Admin\AppData\Local\Temp\juvot.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\nihae.exe

"C:\Users\Admin\AppData\Local\Temp\nihae.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 41.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
KR 218.54.31.226:11110 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
KR 1.234.83.146:11170 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
KR 218.54.31.165:11110 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
JP 133.242.129.155:11110 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

memory/3744-0-0x0000000000400000-0x0000000000462000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\juvot.exe

MD5 71721d6d852b0c2c1870db48f764d11f
SHA1 3e7a35e4c818d6edcc7e4c60cf73cd908652621a
SHA256 ba0e56d8f6855ac8190a3034b65a88d290aeb12dcb5c814501b25016a47e5a0b
SHA512 a1dbdfe805ce9aa8d1651779aa53fe07b19e4218bf0bdf10ebefdda52610d9db2ad534b0e6dd97797fdcfe9e6084186bf0448ffeea26954f1ca73b39db23d89e

memory/4480-11-0x0000000000400000-0x0000000000462000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 f8ad78cf3e005e82efb632b03dd94621
SHA1 da25be72ebfaba110c6fd1016bba2fa03c84ce37
SHA256 47632ec08c6a5a408e6e3cd3d1b99f8c4b75c852486413fdb4fb2dbfa2c30694
SHA512 2afb949695e60e4bbdf32095d555db0c3a39519efb17ce09a28e40bba555b76480a5f62725bfd087be0a064ff3666105ff3ea36e8d206ed12680686751cf4e42

C:\Users\Admin\AppData\Local\Temp\nihae.exe

MD5 7b35805f9e6ff72bd1e51ebf4132df41
SHA1 ea6ca60288adcb8f118cc589aa2c473078347fb2
SHA256 eb003b744c24708bc4cfc3ee4289218111b1abf07fc3f19aa4edf3b1269fea45
SHA512 b00f7f0a0ab28e67145f922655afcf047f7c70761aaab6855481c7074fd2fb1dac8151c2e6ac043def0bb18f980942e37dafb0a949b2682a614c37719ecb2469

memory/2100-23-0x0000000000030000-0x00000000000E4000-memory.dmp

memory/2100-24-0x00000000011F0000-0x00000000011F2000-memory.dmp

memory/2100-26-0x0000000000030000-0x00000000000E4000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-17 01:35

Reported

2024-03-17 01:38

Platform

win7-20240221-en

Max time kernel

169s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe"

Signatures

Urelas

trojan urelas

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\seejd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ramad.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2808 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\seejd.exe
PID 2808 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\seejd.exe
PID 2808 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\seejd.exe
PID 2808 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Users\Admin\AppData\Local\Temp\seejd.exe
PID 2808 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\seejd.exe C:\Users\Admin\AppData\Local\Temp\ramad.exe
PID 2492 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\seejd.exe C:\Users\Admin\AppData\Local\Temp\ramad.exe
PID 2492 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\seejd.exe C:\Users\Admin\AppData\Local\Temp\ramad.exe
PID 2492 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\seejd.exe C:\Users\Admin\AppData\Local\Temp\ramad.exe

Processes

C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe

"C:\Users\Admin\AppData\Local\Temp\edd558c34a72180e44b0eb067930cbdb4a7082f0ec27e6814bc666d711bf7771.exe"

C:\Users\Admin\AppData\Local\Temp\seejd.exe

"C:\Users\Admin\AppData\Local\Temp\seejd.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "

C:\Users\Admin\AppData\Local\Temp\ramad.exe

"C:\Users\Admin\AppData\Local\Temp\ramad.exe"

Network

Country Destination Domain Proto
KR 218.54.31.226:11110 tcp
KR 1.234.83.146:11170 tcp
KR 218.54.31.165:11110 tcp
JP 133.242.129.155:11110 tcp

Files

memory/2808-0-0x0000000000400000-0x0000000000462000-memory.dmp

\Users\Admin\AppData\Local\Temp\seejd.exe

MD5 0568705ae35d1dfa13dcec035a5a9280
SHA1 a2c3895873d5fc271ac204b1148bee1da803cf9f
SHA256 e0ee7a184c27adb7263b53faa35196c7fa68a3617f2070cdb90a8af71e1ac736
SHA512 9a8ffd5e3340ec73bd6f2ed4e1a2a6087f540016e4b8115f33d886d42a36f75d4b9c30b6efc47a58f590ea4590b693cafc00253a3deee4c98f6e85d3d5ab3439

C:\Users\Admin\AppData\Local\Temp\_uinsey.bat

MD5 5de5a24b2248d5b4b4758d811bb82e98
SHA1 e4e9e2759ca498ebeb4f26226f709e6d6ccfa3d3
SHA256 fb65b262f8c267fd370bf55cebb570927668dd814968428262e92a6b6cb76e25
SHA512 e1230a655127643c7d24ee1a4c299f2fb87d12e774c25afd6a2455a0617ac7d014d35ba7bd7612aaaed46491e499ce907eb9bedc1ce869b75771a218ad385c6f

C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

MD5 668b842c1f44a1ef25fcbeede97b1364
SHA1 8607b95423c33b90315ae2b37834ca2b7e6494ee
SHA256 b31da2465570429a1e24cc679f9c8bdf03fbd9faf99162c797ae2efc4d7d6205
SHA512 67c97f0952be0551154639b1862d477722795eb96d0d8f18a3312d2f34c1fc68a40864071d3dee9b751df688e0e7a76801ea641ba03cf9c12de610d7dc69a837

\Users\Admin\AppData\Local\Temp\ramad.exe

MD5 6fef2650c175bd51089427a0ac37559c
SHA1 ac5a49485a682c3611c247c9b67e529f4ccb5270
SHA256 0651c2721e6819c341cc7f7a1cd9369728eb3ad11f4beca35ea1abf9cc571f44
SHA512 407714a93725ea5553fb139375a6899614e402a1c2eb7c8d29ce686422014c575949094b6c7af994ff8ec5eadbe0e347d4c14ab82af1dbac4877542dff4be145

memory/2492-23-0x0000000002D40000-0x0000000002DF4000-memory.dmp

memory/1580-26-0x0000000000860000-0x0000000000914000-memory.dmp

memory/1580-27-0x0000000000100000-0x0000000000102000-memory.dmp

memory/1580-29-0x0000000000860000-0x0000000000914000-memory.dmp

memory/1580-30-0x0000000000860000-0x0000000000914000-memory.dmp

memory/1580-31-0x0000000000100000-0x0000000000102000-memory.dmp

memory/1580-32-0x0000000000860000-0x0000000000914000-memory.dmp

memory/1580-33-0x0000000000860000-0x0000000000914000-memory.dmp

memory/1580-34-0x0000000000860000-0x0000000000914000-memory.dmp