Analysis
- max time kernel
298s - max time network
302s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
08/05/2024, 22:22
General
- Target 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
- Size 385KB
- Sample240508-2agg5sda77
- SHA256 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5
Malware Config
Extracted
-
stealc
-
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Extracted
-
smokeloader
-
pub2
Signatures
- Detect ZGRat V1 3 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 21 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Windows security bypass 2 TTPs 10 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Modifies boot configuration data using bcdedit 14 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
- Drops startup file 7 IoCs
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 35 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 10 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Suspicious use of SetThreadContext 2 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 11 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 11 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of FindShellTrayWindow 10 IoCs
- Suspicious use of SendNotifyMessage 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"C:\Users\Admin\Pictures\QkHWDXnqiBlN8SXTAJxEBlbc.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
-
-
-
-
C:\Users\Admin\Pictures\9YSsFqhRgrlHq7VDb2jnx2eC.exe"C:\Users\Admin\Pictures\9YSsFqhRgrlHq7VDb2jnx2eC.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u18w.0.exe"C:\Users\Admin\AppData\Local\Temp\u18w.0.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\u18w.1.exe"C:\Users\Admin\AppData\Local\Temp\u18w.1.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"C:\Users\Admin\Pictures\RGfhHR5IomI5kKh9k52xPPda.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
-
-
C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"C:\Users\Admin\Pictures\KlQx9CtTguW3jS1XolH53UnX.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
-
-
C:\Users\Admin\Pictures\C2YNPyllyXCvjPcsWpy5xcmG.exe"C:\Users\Admin\Pictures\C2YNPyllyXCvjPcsWpy5xcmG.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Condos Condos.cmd & Condos.cmd & exit5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 11316⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "MAKINGSICKDIFFERENTIALCONSOLES" Reached6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Preparation 1131\W6⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1131\Relation.pif1131\Relation.pif 1131\W6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.16⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"C:\Users\Admin\Pictures\6Pd0jH2BrBsiLMdjihWycS2i.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 08⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 18⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast8⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 08⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}8⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v7⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe7⤵
- Executes dropped EXE
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1304 -s 6683⤵
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1131\Relation.pif"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\1131\Relation.pif"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240508222249.log C:\Windows\Logs\CBS\CbsPersist_20240508222249.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "14772286411767887886-94966295273841853622264961011292889-77277404566936954"1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
ed4cce77ab0b4dc2bf6d37bdc4eefc07.tmp
Assumptions
Bbw
Belly
Breakfast
Cds
Chapter
Chip
Condos
Cooper
Custom
Dawn
Desert
Headline
Ht
K
Lite
Ooo
Phenomenon
Pitch
Radios
Rb
Reached
Relocation
Stress
Surfaces
Technique
Wonder
Za
Cab2A9B.tmp
download.error
download.error
Tar2AAE.tmp
ioloDMLog.txt
ioloDMLog.txt
ioloDMLog.txt
ntkrnlmp.exe
osloader.exe
RGfhHR5IomI5kKh9k52xPPda.exe
u18w.0.exe
u18w.1.exe
9YSsFqhRgrlHq7VDb2jnx2eC.exe
C2YNPyllyXCvjPcsWpy5xcmG.exe
QkHWDXnqiBlN8SXTAJxEBlbc.exe
memory/448-390-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/448-378-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/676-462-0x0000000000400000-0x000000000040B000-memory.dmp
memory/676-392-0x0000000000400000-0x000000000040B000-memory.dmp
memory/860-8-0x0000000000400000-0x0000000000408000-memory.dmp
memory/860-15-0x0000000074E2E000-0x0000000074E2F000-memory.dmp
memory/860-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/860-350-0x0000000074E2E000-0x0000000074E2F000-memory.dmp
memory/860-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/860-352-0x0000000074E20000-0x000000007550E000-memory.dmp
memory/860-5-0x0000000000400000-0x0000000000408000-memory.dmp
memory/860-7-0x0000000000400000-0x0000000000408000-memory.dmp
memory/860-6-0x0000000000400000-0x0000000000408000-memory.dmp
memory/860-16-0x0000000074E20000-0x000000007550E000-memory.dmp
memory/860-10-0x0000000000400000-0x0000000000408000-memory.dmp
memory/860-12-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1208-261-0x0000000004160000-0x0000000004558000-memory.dmp
memory/1208-336-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1304-4-0x000000001AF00000-0x000000001AF5E000-memory.dmp
memory/1304-0-0x000007FEF6053000-0x000007FEF6054000-memory.dmp
memory/1304-3-0x0000000000B10000-0x0000000000B1A000-memory.dmp
memory/1304-2-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp
memory/1304-1-0x0000000000D40000-0x0000000000D4A000-memory.dmp
memory/1304-344-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp
memory/1304-264-0x000007FEF6053000-0x000007FEF6054000-memory.dmp
memory/1472-227-0x00000000042F0000-0x00000000046E8000-memory.dmp
memory/1472-251-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1492-345-0x0000000000400000-0x0000000002574000-memory.dmp
memory/1492-546-0x0000000000400000-0x0000000002574000-memory.dmp
memory/1492-489-0x0000000000400000-0x0000000002574000-memory.dmp
memory/1548-391-0x0000000005C10000-0x0000000005C34000-memory.dmp
memory/1548-414-0x0000000003E80000-0x0000000003E8A000-memory.dmp
memory/1548-478-0x0000000003E80000-0x0000000003E8A000-memory.dmp
memory/1548-479-0x0000000003E80000-0x0000000003E8A000-memory.dmp
memory/1548-460-0x00000000040B0000-0x00000000040BC000-memory.dmp
memory/1548-457-0x000000001EBC0000-0x000000001EBE2000-memory.dmp
memory/1548-456-0x00000000040E0000-0x0000000004142000-memory.dmp
memory/1548-455-0x00000000040A0000-0x00000000040AA000-memory.dmp
memory/1548-415-0x0000000003E80000-0x0000000003E8A000-memory.dmp
memory/1548-369-0x00000000003C0000-0x0000000003BF4000-memory.dmp
memory/1548-412-0x000000001FB40000-0x000000001FE40000-memory.dmp
memory/1548-408-0x0000000000300000-0x000000000030A000-memory.dmp
memory/1548-374-0x000000001E5C0000-0x000000001E6CA000-memory.dmp
memory/1548-395-0x000000001F560000-0x000000001F612000-memory.dmp
memory/1548-381-0x0000000003ED0000-0x0000000003EDC000-memory.dmp
memory/1548-380-0x0000000000260000-0x0000000000270000-memory.dmp
memory/1548-393-0x00000000002F0000-0x00000000002FA000-memory.dmp
memory/1548-385-0x0000000003CE0000-0x0000000003CF4000-memory.dmp
memory/1548-394-0x0000000000390000-0x00000000003BA000-memory.dmp
memory/1616-277-0x0000000000400000-0x0000000002597000-memory.dmp
memory/1616-263-0x0000000000400000-0x0000000002597000-memory.dmp
memory/1744-530-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-516-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-547-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-371-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-536-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-550-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-488-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-544-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-351-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-327-0x0000000004250000-0x0000000004648000-memory.dmp
memory/1744-490-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1744-476-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1768-252-0x0000000000400000-0x0000000002957000-memory.dmp
memory/1768-231-0x00000000041B0000-0x00000000045A8000-memory.dmp
memory/2112-533-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2112-529-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2456-257-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2456-145-0x0000000004340000-0x0000000004738000-memory.dmp
memory/2456-262-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2484-348-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2484-265-0x0000000004380000-0x0000000004778000-memory.dmp
memory/2656-255-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2656-194-0x00000000043A0000-0x0000000004798000-memory.dmp
memory/2764-322-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2764-258-0x0000000004330000-0x0000000004728000-memory.dmp
memory/2792-368-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2792-532-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2792-535-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2792-370-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2792-349-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2792-548-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2812-347-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2812-259-0x0000000004310000-0x0000000004708000-memory.dmp
memory/2812-346-0x0000000000400000-0x0000000002957000-memory.dmp