Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
21/04/2024, 08:33
General
- Target droidkit-en-setup.exe
- Size 19.5MB
- Sample240421-kgcdbsfb25
- SHA256 ae2001d5b60a2f0bd8e72c0106363950cd9f68e9ce42b9a40b0af26814908809
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 26 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies system certificate store 2 TTPs 8 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 53 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe"C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Start Download\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Start Download\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Download Successful\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Download Successful\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Install Finished\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Install Finished\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Start Application\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"F8065D23\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Start Application\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.1\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"3⤵
-
-
-
C:\Program Files (x86)\iMobie\DroidKit\DroidKit.exe"C:\Program Files (x86)\iMobie\DroidKit\DroidKit.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\iMobie\DroidKit\aapt.exe"C:\Program Files (x86)\iMobie\DroidKit\aapt.exe" dump badging imobieservice.apk3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.imobie.com/droidkit/thankyou/install-complete.htm2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff6f0446f8,0x7fff6f044708,0x7fff6f0447183⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14792053221173408155,11035797945571319817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:13⤵
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CommonServiceLocator.dll
Core.Http.dll
Core.Partition.dll
Core.Tracing.GA4.dll
Core.Tracing.dll
DroidKit.Enum.dll
DroidKit.exe
DroidKit.exe.config
Google.Protobuf.dll
Help.ico
Language.Default.dll
Language.AR.dll
Module.Base.dll
Prism.Unity.Wpf.dll
Prism.Wpf.dll
Prism.dll
ResourcesBridge.dll
System.Windows.Interactivity.dll
Theme.Default.dll
UI.Controls.dll
Unity.Abstractions.dll
Utilities.UI.dll
Utilities.dll
droidkit.7z
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
libusbK.dll
log4net.dll
uninstall.ini
libusb0.dll
DroidKit Online Help.url
103621DE9CD5414CC2538780B4B75751
1B1495DD322A24490E2BF2FAABAE1C61
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
265C0DEB29181DD1891051371C5F863A_287645BCBA32F35B745B436FF45A6C8B
CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
103621DE9CD5414CC2538780B4B75751
1B1495DD322A24490E2BF2FAABAE1C61
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
265C0DEB29181DD1891051371C5F863A_287645BCBA32F35B745B436FF45A6C8B
CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
settings.dat
settings.dat
the-real-index
Preferences
Preferences
CURRENT
Local State
BgWorker.dll
CheckProVs.dll
GoogleTracingLib.dll
System.dll
msvcp100.dll
msvcr100.dll
nsDui.dll
nsProcess.dll
nsis7z.dll
registry.dll
track_Official-com.txt
uninstall.exe
lang_info.xml
settings
memory/1216-1636-0x000001F9ABCD0000-0x000001F9ABCE6000-memory.dmp
memory/1216-1689-0x000001F9AC240000-0x000001F9AC280000-memory.dmp
memory/1216-1634-0x000001F9AB3D0000-0x000001F9AB3E0000-memory.dmp
memory/1216-1605-0x000001F9ABD60000-0x000001F9ABE3A000-memory.dmp
memory/1216-1603-0x000001F9AB6A0000-0x000001F9AB6FE000-memory.dmp
memory/1216-1601-0x000001F9AB5C0000-0x000001F9AB5D4000-memory.dmp
memory/1216-1643-0x000001F9AB7B0000-0x000001F9AB7BC000-memory.dmp
memory/1216-1646-0x000001F9ABD50000-0x000001F9ABD58000-memory.dmp
memory/1216-1645-0x000001F9AB7C0000-0x000001F9AB7C8000-memory.dmp
memory/1216-1648-0x000001F9AC1A0000-0x000001F9AC1B6000-memory.dmp
memory/1216-1595-0x000001F9AA4A0000-0x000001F9AA4AE000-memory.dmp
memory/1216-1593-0x000001F9AB3D0000-0x000001F9AB3E0000-memory.dmp
memory/1216-1592-0x000001F9AB600000-0x000001F9AB634000-memory.dmp
memory/1216-1588-0x000001F9AB390000-0x000001F9AB3A6000-memory.dmp
memory/1216-1650-0x000001F9AC180000-0x000001F9AC190000-memory.dmp
memory/1216-1652-0x000001F9AC190000-0x000001F9AC19E000-memory.dmp
memory/1216-1653-0x000001F9AC200000-0x000001F9AC238000-memory.dmp
memory/1216-1659-0x000001F9AC2B0000-0x000001F9AC314000-memory.dmp
memory/1216-1581-0x000001F9AE0A0000-0x000001F9B04B4000-memory.dmp
memory/1216-1568-0x000001F9AB450000-0x000001F9AB484000-memory.dmp
memory/1216-1669-0x000001F9AC320000-0x000001F9AC36C000-memory.dmp
memory/1216-1566-0x000001F9AB370000-0x000001F9AB38E000-memory.dmp
memory/1216-1559-0x000001F9AB320000-0x000001F9AB366000-memory.dmp
memory/1216-1557-0x000001F9AB3D0000-0x000001F9AB3E0000-memory.dmp
memory/1216-1555-0x000001F9AB7D0000-0x000001F9ABC80000-memory.dmp
memory/1216-1540-0x000001F990350000-0x000001F990366000-memory.dmp
memory/1216-1538-0x00007FFF73540000-0x00007FFF74001000-memory.dmp
memory/1216-1672-0x000001F9AC370000-0x000001F9AC3B6000-memory.dmp
memory/1216-1675-0x000001F9AC3C0000-0x000001F9AC404000-memory.dmp
memory/1216-1676-0x000001F9AC410000-0x000001F9AC454000-memory.dmp
memory/1216-1681-0x000001F9AC460000-0x000001F9AC4A2000-memory.dmp
memory/1216-1682-0x000001F9AC4B0000-0x000001F9AC4F8000-memory.dmp
memory/1216-1686-0x000001F9AC500000-0x000001F9AC544000-memory.dmp
memory/1216-1637-0x000001F9ABCF0000-0x000001F9ABD4A000-memory.dmp
memory/1216-1690-0x000001F9AC5A0000-0x000001F9AC5E2000-memory.dmp
memory/1216-1691-0x000001F9AC5F0000-0x000001F9AC632000-memory.dmp
memory/1216-1693-0x000001F9AC550000-0x000001F9AC58A000-memory.dmp
memory/1216-1694-0x000001F9AC280000-0x000001F9AC2AA000-memory.dmp
memory/1216-1695-0x000001F9AC1E0000-0x000001F9AC1F4000-memory.dmp
memory/1216-1700-0x000001F9AC1D0000-0x000001F9AC1D8000-memory.dmp
memory/1216-1701-0x000001F9AC590000-0x000001F9AC59A000-memory.dmp
memory/1216-1706-0x000001F9ACA40000-0x000001F9ACA48000-memory.dmp
memory/1216-1707-0x000001F9ACA70000-0x000001F9ACA8C000-memory.dmp
memory/1216-1709-0x000001F9ACBA0000-0x000001F9ACBBA000-memory.dmp
memory/1216-1708-0x000001F9ACB90000-0x000001F9ACB9A000-memory.dmp
memory/1216-1711-0x000001F9AD0F0000-0x000001F9AD620000-memory.dmp
memory/1216-1710-0x000001F9B04C0000-0x000001F9B0F9E000-memory.dmp
memory/1216-1712-0x000001F9AD1C0000-0x000001F9AD7BE000-memory.dmp
memory/1216-1713-0x000001F9ACD00000-0x000001F9ACE40000-memory.dmp
memory/1216-1714-0x000001F9ACFC0000-0x000001F9AD13C000-memory.dmp
memory/1216-1715-0x000001F9ACBC0000-0x000001F9ACBE0000-memory.dmp
memory/1216-1716-0x000001F9ADB30000-0x000001F9ADE96000-memory.dmp
memory/1216-1717-0x000001F9B1320000-0x000001F9B169A000-memory.dmp
memory/1216-1718-0x000001F9ACE40000-0x000001F9ACEDC000-memory.dmp
memory/1216-1719-0x000001F9ACC50000-0x000001F9ACCB6000-memory.dmp
memory/1216-1720-0x000001F9B0FA0000-0x000001F9B1226000-memory.dmp
memory/1216-1722-0x000001F9ACEE0000-0x000001F9ACF46000-memory.dmp
memory/1216-1721-0x000001F9ACCC0000-0x000001F9ACD00000-memory.dmp
memory/1216-1723-0x00007FFF6C540000-0x00007FFF6C8A9000-memory.dmp
memory/1216-1725-0x000001F9ACA60000-0x000001F9ACA70000-memory.dmp
memory/1216-1724-0x000001F9ACBE0000-0x000001F9ACBF6000-memory.dmp
memory/1216-1533-0x000001F98FF10000-0x000001F98FF6E000-memory.dmp
memory/1216-1537-0x000001F9904A0000-0x000001F9904C8000-memory.dmp
memory/1216-1535-0x000001F9902F0000-0x000001F9902FC000-memory.dmp
memory/3020-1500-0x0000000002EB0000-0x0000000002F09000-memory.dmp
memory/4428-1748-0x0000000000400000-0x00000000004D4000-memory.dmp