Analysis
- max time kernel
93s - max time network
170s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
07/04/2024, 23:55
General
- Target ebf6539f6215b56b0bf3a64d4d1736787c77470e2c6245b47838b5c31e38a388.exe
- Size 1.8MB
- Sample240407-3ytm2sad2t
- SHA256 ebf6539f6215b56b0bf3a64d4d1736787c77470e2c6245b47838b5c31e38a388
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
4.185.137.132:1632
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Extracted
-
stealc
-
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 6 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 7 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 11 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf6539f6215b56b0bf3a64d4d1736787c77470e2c6245b47838b5c31e38a388.exe"C:\Users\Admin\AppData\Local\Temp\ebf6539f6215b56b0bf3a64d4d1736787c77470e2c6245b47838b5c31e38a388.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 8923⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 8643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\852399462405_Desktop.zip' -CompressionLevel Optimal4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
-
C:\Users\Admin\Pictures\teyOLUX0XBE0g70O3QCTLOGx.exe"C:\Users\Admin\Pictures\teyOLUX0XBE0g70O3QCTLOGx.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u24k.0.exe"C:\Users\Admin\AppData\Local\Temp\u24k.0.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CFBAKEHIEB.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\CFBAKEHIEB.exe"C:\Users\Admin\AppData\Local\Temp\CFBAKEHIEB.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\CFBAKEHIEB.exe8⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30009⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 35126⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u24k.1.exe"C:\Users\Admin\AppData\Local\Temp\u24k.1.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 15325⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\fICFROH4tbpRT7V6gKbfYxsh.exe"C:\Users\Admin\Pictures\fICFROH4tbpRT7V6gKbfYxsh.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\fICFROH4tbpRT7V6gKbfYxsh.exe"C:\Users\Admin\Pictures\fICFROH4tbpRT7V6gKbfYxsh.exe"5⤵
-
-
-
C:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exe"C:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exeC:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6bd7e1d0,0x6bd7e1dc,0x6bd7e1e85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\79hVJ3yciH0OApNPy2nGRwjd.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\79hVJ3yciH0OApNPy2nGRwjd.exe" --version5⤵
-
-
C:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exe"C:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=664 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240407235745" --session-guid=a930af75-fe04-4b01-9b1e-22ba0d6acf2e --server-tracking-blob=NDA1OGJlZjg3ZGNlNmM2ZjU0ZmQ0NDMyMTE0MzE0MGRlMWM4N2JjYWUwYWFmZDYyYzUyZGFmMmNkODYwYTQ5Mjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTI1MzQyNTguNTI5MSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjkzNzNjMjI3LWQ2MjUtNDQ5Zi05MmM0LWRjYmM4NTM4M2NkNyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=28060000000000005⤵
-
C:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exeC:\Users\Admin\Pictures\79hVJ3yciH0OApNPy2nGRwjd.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6b22e1d0,0x6b22e1dc,0x6b22e1e86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404072357451\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404072357451\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404072357451\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404072357451\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404072357451\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404072357451\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7f0040,0x7f004c,0x7f00586⤵
-
-
-
-
C:\Users\Admin\Pictures\IiStXXpKx4qy91ILlGIUGq9K.exe"C:\Users\Admin\Pictures\IiStXXpKx4qy91ILlGIUGq9K.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\IiStXXpKx4qy91ILlGIUGq9K.exe"C:\Users\Admin\Pictures\IiStXXpKx4qy91ILlGIUGq9K.exe"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001107001\new1.exe"C:\Users\Admin\AppData\Local\Temp\1001107001\new1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3728 -ip 37281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2756 -ip 27561⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 444 -ip 4441⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
KJKKKJJJ
KKJJEBFC
freebl3.dll
mozglue.dll
nss3.dll
6jtHiNLrZfUT6tBfDswwAEl3.exe
powershell.exe.log
StartupProfileData-NonInteractive
additional_file0.tmp
opera_package
explorgu.exe
alexxxxxxxx.exe
32456.exe
goldprimeldlldf.exe
NewB.exe
swiiiii.exe
koooooo.exe
random.exe
file300un.exe
new1.exe
swiiii.exe
Opera_installer_240407235741915664.dll
TmpFBFF.tmp
__PSScriptPolicyTest_4corhiod.4i3.ps1
ioloDMLog.txt
ioloDMLog.txt
tmp407E.tmp
tmp43FC.tmp
u24k.0.exe
u24k.1.exe
clip64.dll
cred64.dll
76b53b3ec448f7ccdda2063b15d2bfc3_64d87529-6233-45c4-bbce-8eb6b51089f8
settings.dat
Traffic.exe
propro.exe
Microsoft Edge.lnk
79hVJ3yciH0OApNPy2nGRwjd.exe
TebwMwjDFcW0PHcbAiVnGIqh.exe
WUdwHDDFsB8Ca6uoDTeWwaFz.exe
teyOLUX0XBE0g70O3QCTLOGx.exe
Google Chrome.lnk
Google Chrome.lnk
memory/400-244-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/400-245-0x00000000006D0000-0x0000000000722000-memory.dmp
memory/400-255-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/444-768-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/720-251-0x0000000000400000-0x000000000044C000-memory.dmp
memory/720-256-0x0000000000400000-0x000000000044C000-memory.dmp
memory/872-215-0x0000000000400000-0x000000000044C000-memory.dmp
memory/872-211-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/872-170-0x0000000000400000-0x000000000044C000-memory.dmp
memory/872-182-0x0000000000400000-0x000000000044C000-memory.dmp
memory/940-104-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/940-142-0x00000000034C0000-0x00000000054C0000-memory.dmp
memory/940-86-0x0000000000ED0000-0x000000000108C000-memory.dmp
memory/940-92-0x00000000059E0000-0x00000000059F0000-memory.dmp
memory/940-141-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/1060-738-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1080-571-0x000000001BE70000-0x000000001C023000-memory.dmp
memory/1080-375-0x000000001BE70000-0x000000001C023000-memory.dmp
memory/2712-9-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/2712-0-0x0000000000220000-0x00000000006E2000-memory.dmp
memory/2712-4-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/2712-1-0x00000000778B6000-0x00000000778B8000-memory.dmp
memory/2712-15-0x0000000000220000-0x00000000006E2000-memory.dmp
memory/2712-7-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/2712-3-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/2712-8-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/2712-2-0x0000000000220000-0x00000000006E2000-memory.dmp
memory/2712-10-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/2712-6-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/2712-5-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/2732-454-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-327-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-317-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-316-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-315-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-313-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-311-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-310-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2732-309-0x0000000000D30000-0x00000000014D6000-memory.dmp
memory/2744-172-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/2744-197-0x0000000002810000-0x0000000004810000-memory.dmp
memory/2744-146-0x0000000000410000-0x0000000000462000-memory.dmp
memory/2756-737-0x0000000000400000-0x000000000048D000-memory.dmp
memory/2996-246-0x000000001E540000-0x000000001E552000-memory.dmp
memory/2996-89-0x000000001B6D0000-0x000000001B6E0000-memory.dmp
memory/2996-84-0x0000000000850000-0x00000000008D2000-memory.dmp
memory/2996-248-0x000000001E5A0000-0x000000001E5DC000-memory.dmp
memory/2996-87-0x00007FF9E5DA0000-0x00007FF9E6862000-memory.dmp
memory/2996-194-0x000000001BB40000-0x000000001BBB6000-memory.dmp
memory/2996-250-0x000000001B6D0000-0x000000001B6E0000-memory.dmp
memory/2996-252-0x000000001B880000-0x000000001BA33000-memory.dmp
memory/2996-243-0x000000001E650000-0x000000001E75A000-memory.dmp
memory/2996-196-0x000000001DF90000-0x000000001DFAE000-memory.dmp
memory/2996-558-0x000000001B880000-0x000000001BA33000-memory.dmp
memory/3508-401-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3580-529-0x0000000000400000-0x000000000063B000-memory.dmp
memory/3580-597-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3580-514-0x0000000000400000-0x000000000063B000-memory.dmp
memory/3728-237-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/3728-219-0x0000000000380000-0x00000000003E6000-memory.dmp
memory/3828-175-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/3828-138-0x00000000052E0000-0x0000000005372000-memory.dmp
memory/3828-209-0x00000000080A0000-0x00000000081AA000-memory.dmp
memory/3828-212-0x0000000007FD0000-0x000000000800C000-memory.dmp
memory/3828-149-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/3828-129-0x00000000057B0000-0x0000000005D56000-memory.dmp
memory/3828-216-0x0000000008020000-0x000000000806C000-memory.dmp
memory/3828-195-0x0000000006690000-0x0000000006CA8000-memory.dmp
memory/3828-110-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3828-210-0x0000000006670000-0x0000000006682000-memory.dmp
memory/3828-160-0x0000000005480000-0x000000000548A000-memory.dmp
memory/4012-144-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-28-0x0000000005990000-0x0000000005991000-memory.dmp
memory/4012-24-0x0000000005910000-0x0000000005911000-memory.dmp
memory/4012-25-0x0000000005920000-0x0000000005921000-memory.dmp
memory/4012-23-0x0000000005980000-0x0000000005981000-memory.dmp
memory/4012-26-0x0000000005970000-0x0000000005971000-memory.dmp
memory/4012-20-0x0000000005940000-0x0000000005941000-memory.dmp
memory/4012-22-0x0000000005930000-0x0000000005931000-memory.dmp
memory/4012-21-0x0000000005950000-0x0000000005951000-memory.dmp
memory/4012-19-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-18-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-27-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/4012-733-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-570-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-413-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-173-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-227-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4012-291-0x0000000000EA0000-0x0000000001362000-memory.dmp
memory/4408-116-0x0000000002680000-0x0000000004680000-memory.dmp
memory/4408-143-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/4408-91-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/4408-90-0x00000000002E0000-0x000000000035A000-memory.dmp
memory/4880-117-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4880-161-0x0000000073270000-0x0000000073A21000-memory.dmp
memory/4880-174-0x00000000054C0000-0x00000000054D0000-memory.dmp