Analysis
- max time kernel
108s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
27/04/2024, 12:36
General
- Target cdcfa98c7efbf68dd371743d83ff683043bfbf8370b53401172625f0cf9d85d1.exe
- Size 1.8MB
- Sample240427-ps7qtsbc2z
- SHA256 cdcfa98c7efbf68dd371743d83ff683043bfbf8370b53401172625f0cf9d85d1
Malware Config
Extracted
-
amadey
-
4.17
-
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
-
redline
-
@CLOUDYTTEAM
-
185.172.128.33:8970
Extracted
-
redline
-
Test1234
-
185.215.113.67:26260
Extracted
-
stealc
-
http://52.143.157.84
-
http://185.172.128.76
-
url_path
/c73eed764cc59dcb.php
Extracted
-
amadey
-
4.17
-
http://193.233.132.167
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 6 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 5 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 19 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 5 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdcfa98c7efbf68dd371743d83ff683043bfbf8370b53401172625f0cf9d85d1.exe"C:\Users\Admin\AppData\Local\Temp\cdcfa98c7efbf68dd371743d83ff683043bfbf8370b53401172625f0cf9d85d1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 8843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 4083⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 4083⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1lc.0.exe"C:\Users\Admin\AppData\Local\Temp\u1lc.0.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\u1lc.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1lc.2\run.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1lc.3.exe"C:\Users\Admin\AppData\Local\Temp\u1lc.3.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 18044⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 3844⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Modifies data under HKEY_USERS
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\062789476783_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exe"C:\Users\Admin\AppData\Local\Temp\1000231001\lie.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 14081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3044 -ip 30441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 680 -ip 6801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2064 -ip 20641⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
swiiiii.exe
alexxxxxxxx.exe
gold.exe
NewB.exe
jok.exe
swiiii.exe
ISetup8.exe
toolspub1.exe
4767d2e713f2021e8fe856e3ea638b58.exe
lie.exe
chrosha.exe
75d7621d
TmpDB9B.tmp
__PSScriptPolicyTest_0r2mjjia.ymf.ps1
ioloDMLog.txt
ioloDMLog.txt
u1lc.0.exe
u1lc.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u1lc.3.exe
76b53b3ec448f7ccdda2063b15d2bfc3_0c7f3946-7653-4b87-8d45-55ff4293dffb
clip64.dll
cred64.dll
keks.exe
trf.exe
Microsoft Edge.lnk
Microsoft Edge.lnk
Google Chrome.lnk
Google Chrome.lnk
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
memory/696-53-0x0000000000400000-0x000000000044C000-memory.dmp
memory/696-51-0x0000000000400000-0x000000000044C000-memory.dmp
memory/748-71-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1144-573-0x000001829D8C0000-0x000001829D8D2000-memory.dmp
memory/1144-574-0x000001829D8A0000-0x000001829D8AA000-memory.dmp
memory/1144-522-0x000001829D700000-0x000001829D722000-memory.dmp
memory/1164-561-0x0000000000400000-0x0000000002EDD000-memory.dmp
memory/1164-640-0x0000000000400000-0x0000000002EDD000-memory.dmp
memory/1408-47-0x0000000000BA0000-0x0000000000BF2000-memory.dmp
memory/1408-48-0x0000000072F00000-0x00000000736B1000-memory.dmp
memory/1408-54-0x0000000072F00000-0x00000000736B1000-memory.dmp
memory/1772-558-0x0000000008440000-0x000000000896C000-memory.dmp
memory/1772-95-0x0000000004BC0000-0x0000000004C52000-memory.dmp
memory/1772-138-0x0000000006220000-0x000000000625C000-memory.dmp
memory/1772-137-0x00000000061C0000-0x00000000061D2000-memory.dmp
memory/1772-136-0x0000000006280000-0x000000000638A000-memory.dmp
memory/1772-135-0x00000000065F0000-0x0000000006C08000-memory.dmp
memory/1772-131-0x0000000005EB0000-0x0000000005ECE000-memory.dmp
memory/1772-126-0x00000000056C0000-0x0000000005736000-memory.dmp
memory/1772-106-0x0000000004BB0000-0x0000000004BBA000-memory.dmp
memory/1772-139-0x0000000006390000-0x00000000063DC000-memory.dmp
memory/1772-94-0x0000000005090000-0x0000000005636000-memory.dmp
memory/1772-92-0x00000000001C0000-0x0000000000212000-memory.dmp
memory/1772-557-0x0000000007D40000-0x0000000007F02000-memory.dmp
memory/1772-284-0x00000000064E0000-0x0000000006546000-memory.dmp
memory/1848-567-0x0000000000400000-0x00000000005C4000-memory.dmp
memory/1848-568-0x0000000002220000-0x0000000002271000-memory.dmp
memory/1848-641-0x0000000000400000-0x00000000005C4000-memory.dmp
memory/1848-652-0x0000000002220000-0x0000000002271000-memory.dmp
memory/2064-538-0x0000000000400000-0x0000000002B1F000-memory.dmp
memory/2148-175-0x0000000000380000-0x00000000003D2000-memory.dmp
memory/2148-471-0x0000000007110000-0x0000000007160000-memory.dmp
memory/2424-776-0x0000000000400000-0x0000000002EDD000-memory.dmp
memory/2424-767-0x0000000000400000-0x0000000002EDD000-memory.dmp
memory/2676-698-0x00000000056C0000-0x0000000005A17000-memory.dmp
memory/2676-707-0x0000000006110000-0x000000000615C000-memory.dmp
memory/2676-708-0x0000000072A40000-0x0000000072A8C000-memory.dmp
memory/2676-709-0x000000006F900000-0x000000006FC57000-memory.dmp
memory/2720-27-0x0000000005580000-0x0000000005581000-memory.dmp
memory/2720-22-0x0000000005520000-0x0000000005521000-memory.dmp
memory/2720-636-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-487-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-766-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-775-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-788-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-26-0x0000000005590000-0x0000000005591000-memory.dmp
memory/2720-637-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-683-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-684-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-20-0x0000000005530000-0x0000000005531000-memory.dmp
memory/2720-21-0x0000000005540000-0x0000000005541000-memory.dmp
memory/2720-18-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-23-0x0000000005560000-0x0000000005561000-memory.dmp
memory/2720-559-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-24-0x0000000005500000-0x0000000005501000-memory.dmp
memory/2720-25-0x0000000005510000-0x0000000005511000-memory.dmp
memory/2720-696-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/2720-19-0x0000000000A90000-0x0000000000F52000-memory.dmp
memory/3168-486-0x000000006B540000-0x000000006B6BD000-memory.dmp
memory/3168-543-0x000000006B540000-0x000000006B6BD000-memory.dmp
memory/3168-491-0x00007FFF5D420000-0x00007FFF5D629000-memory.dmp
memory/3392-293-0x0000000000400000-0x0000000002AF3000-memory.dmp
memory/3452-790-0x0000000000400000-0x0000000002EDD000-memory.dmp
memory/3476-674-0x0000025DDD960000-0x0000025DDD998000-memory.dmp
memory/3476-671-0x0000025DD9610000-0x0000025DD9910000-memory.dmp
memory/3476-657-0x0000025DD9150000-0x0000025DD9260000-memory.dmp
memory/3476-660-0x0000025DD8E00000-0x0000025DD8E14000-memory.dmp
memory/3476-661-0x0000025DD8E80000-0x0000025DD8EA4000-memory.dmp
memory/3476-659-0x0000025DD8E10000-0x0000025DD8E1C000-memory.dmp
memory/3476-681-0x0000025DDE090000-0x0000025DDE0E0000-memory.dmp
memory/3476-682-0x0000025DDE040000-0x0000025DDE04C000-memory.dmp
memory/3476-678-0x0000025DDE820000-0x0000025DDED48000-memory.dmp
memory/3476-676-0x0000025DDE2C0000-0x0000025DDE2CA000-memory.dmp
memory/3476-677-0x0000025DDE2D0000-0x0000025DDE2F2000-memory.dmp
memory/3476-675-0x0000025DDD930000-0x0000025DDD93E000-memory.dmp
memory/3476-673-0x0000025DDE020000-0x0000025DDE028000-memory.dmp
memory/3476-656-0x0000025DBB030000-0x0000025DBE928000-memory.dmp
memory/3476-667-0x0000025DBEFE0000-0x0000025DBEFEA000-memory.dmp
memory/3476-664-0x0000025DD8EC0000-0x0000025DD8EEA000-memory.dmp
memory/3476-665-0x0000025DD9260000-0x0000025DD92DA000-memory.dmp
memory/3476-666-0x0000025DD8EF0000-0x0000025DD8F52000-memory.dmp
memory/3476-663-0x0000025DD9460000-0x0000025DD9512000-memory.dmp
memory/3476-662-0x0000025DD8EB0000-0x0000025DD8EBA000-memory.dmp
memory/3476-658-0x0000025DD8DF0000-0x0000025DD8E00000-memory.dmp
memory/3516-686-0x000000006B540000-0x000000006B6BD000-memory.dmp
memory/3516-571-0x00007FFF5D420000-0x00007FFF5D629000-memory.dmp
memory/4196-560-0x0000000000400000-0x0000000002AFA000-memory.dmp
memory/4196-773-0x0000000000400000-0x0000000002AFA000-memory.dmp
memory/4232-631-0x0000000007290000-0x00000000072AA000-memory.dmp
memory/4232-627-0x00000000071F0000-0x0000000007286000-memory.dmp
memory/4232-609-0x0000000005BB0000-0x0000000005BCE000-memory.dmp
memory/4232-599-0x0000000005600000-0x0000000005666000-memory.dmp
memory/4232-611-0x00000000719D0000-0x0000000071A1C000-memory.dmp
memory/4232-612-0x000000006B7E0000-0x000000006BB37000-memory.dmp
memory/4232-596-0x00000000046F0000-0x0000000004726000-memory.dmp
memory/4232-597-0x0000000004E80000-0x00000000054AA000-memory.dmp
memory/4232-632-0x00000000071E0000-0x00000000071E8000-memory.dmp
memory/4232-598-0x0000000005560000-0x0000000005582000-memory.dmp
memory/4232-630-0x00000000071A0000-0x00000000071B5000-memory.dmp
memory/4232-629-0x0000000007190000-0x000000000719E000-memory.dmp
memory/4232-628-0x0000000007160000-0x0000000007171000-memory.dmp
memory/4232-610-0x0000000006DC0000-0x0000000006DF4000-memory.dmp
memory/4232-626-0x0000000006FE0000-0x0000000006FEA000-memory.dmp
memory/4232-625-0x0000000006F60000-0x0000000006F7A000-memory.dmp
memory/4232-624-0x00000000075B0000-0x0000000007C2A000-memory.dmp
memory/4232-608-0x0000000005750000-0x0000000005AA7000-memory.dmp
memory/4232-621-0x0000000006E00000-0x0000000006E1E000-memory.dmp
memory/4232-622-0x0000000006E30000-0x0000000006ED4000-memory.dmp
memory/4432-130-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4432-132-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4548-274-0x0000000000140000-0x000000000016E000-memory.dmp
memory/4640-623-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/4640-655-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/4856-9-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/4856-2-0x0000000000400000-0x00000000008C2000-memory.dmp
memory/4856-1-0x0000000077546000-0x0000000077548000-memory.dmp
memory/4856-5-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/4856-15-0x0000000000400000-0x00000000008C2000-memory.dmp
memory/4856-4-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/4856-0-0x0000000000400000-0x00000000008C2000-memory.dmp
memory/4856-3-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/4856-10-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/4856-6-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/4856-7-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/4892-306-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4892-278-0x0000000000400000-0x000000000063B000-memory.dmp
memory/4892-280-0x0000000000400000-0x000000000063B000-memory.dmp
memory/5036-107-0x0000000000D60000-0x0000000000E20000-memory.dmp
memory/5036-225-0x000000001C8F0000-0x000000001C966000-memory.dmp
memory/5036-228-0x000000001CB70000-0x000000001CB8E000-memory.dmp
memory/5052-689-0x000000006E450000-0x000000006F767000-memory.dmp
memory/5052-695-0x0000000005080000-0x000000000508A000-memory.dmp
memory/5052-694-0x0000000000A30000-0x0000000000AF6000-memory.dmp