Analysis Overview
SHA256
b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6
Threat Level: Known bad
The file b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6 was found to be: Known bad.
Malicious Activity Summary
OutSteel
OutSteel batch script
Deletes itself
Reads user/profile data of web browsers
Enumerates connected drives
AutoIT Executable
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-10 13:32
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-10 13:32
Reported
2024-04-10 13:34
Platform
win7-20240220-en
Max time kernel
120s
Max time network
120s
Command Line
Signatures
OutSteel
OutSteel batch script
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Reads user/profile data of web browsers
Enumerates connected drives
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2904 set thread context of 2136 | N/A | C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe | C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe
"C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe"
C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe
C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.doc" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.pdf" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.ppt" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.dot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.xl" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.csv" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.rtf" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.dot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.mdb" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.accdb" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.pot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.pps" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.ppa" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.rar" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.zip" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.tar" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.7z" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "f:\*.txt" /S /B /A
C:\Windows\SysWOW64\cmd.exe
cmd /c start /min r.bat
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K r.bat
C:\Windows\SysWOW64\cmd.exe
cmd /min /c del "C:\Users\Admin\AppData\Local\Temp\r.bat"
C:\Windows\SysWOW64\taskkill.exe
Taskkill /IM cmd.exe /F
Network
| Country | Destination | Domain | Proto |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp |
Files
memory/2904-0-0x0000000000F40000-0x0000000000FD8000-memory.dmp
memory/2904-1-0x0000000074360000-0x0000000074A4E000-memory.dmp
memory/2904-2-0x0000000007190000-0x00000000071D0000-memory.dmp
memory/2904-3-0x0000000000260000-0x0000000000270000-memory.dmp
memory/2136-4-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2904-7-0x0000000074360000-0x0000000074A4E000-memory.dmp
memory/2136-6-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-8-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-9-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-15-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-19-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-27-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-39-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-43-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-47-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-51-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-59-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-63-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-67-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-81-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2136-155-0x0000000000400000-0x00000000004E2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\r.bat
| MD5 | 5367805f2041fd812015cdcda89e30e5 |
| SHA1 | fa8c2b05a6b848eec470a85b62d3a909522b8388 |
| SHA256 | 96d9464290eeebd77c05706c291258e4d5a8f0a80478e118fc9c934ec0489511 |
| SHA512 | c043c1d9fda5761c8e05195c7b78d4cc705c4ef7bf0c2c8259da32812e698532b73bcace51d236d921c834414d1eac0f21c8d0087c4517772ff6047ee8503df3 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-10 13:32
Reported
2024-04-10 13:34
Platform
win10v2004-20231215-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
OutSteel
Reads user/profile data of web browsers
Enumerates connected drives
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2940 set thread context of 1808 | N/A | C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe | C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe
"C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe"
C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe
C:\Users\Admin\AppData\Local\Temp\b0b4550ba09080e02c8a15cec8b5aeaa9fbb193cec1d92c793bdede78a70cec6.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| RU | 45.146.164.37:8080 | tcp | |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.58.20.217.in-addr.arpa | udp |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp | |
| RU | 45.146.164.37:8080 | tcp |
Files
memory/2940-0-0x0000000000050000-0x00000000000E8000-memory.dmp
memory/2940-1-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/2940-2-0x00000000074A0000-0x0000000007A44000-memory.dmp
memory/2940-3-0x0000000006FA0000-0x0000000007032000-memory.dmp
memory/2940-4-0x0000000007200000-0x0000000007210000-memory.dmp
memory/2940-5-0x0000000007060000-0x000000000706A000-memory.dmp
memory/2940-6-0x0000000007210000-0x0000000007286000-memory.dmp
memory/2940-7-0x0000000002460000-0x000000000247E000-memory.dmp
memory/2940-8-0x00000000024C0000-0x00000000024D0000-memory.dmp
memory/1808-10-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-9-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-12-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/2940-13-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/1808-14-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-15-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-17-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-21-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-25-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-29-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-34-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-33-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-37-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-41-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-42-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-45-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-49-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-53-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-54-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-61-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-65-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-69-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-73-0x0000000000400000-0x00000000004E2000-memory.dmp
memory/1808-87-0x0000000000400000-0x00000000004E2000-memory.dmp