Analysis
- max time kernel
126s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
10/05/2024, 01:22
General
- Target 5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe
- Size 389KB
- Sample240510-brglcsae6v
- SHA256 5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f
Malware Config
Extracted
-
stealc
-
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
- Detect ZGRat V1 3 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 10 IoCs
- Stealc
Stealc is an infostealer written in C++.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Detect binaries embedding considerable number of MFA browser extension IDs. 3 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
- Detects Windows executables referencing non-Windows User-Agents 10 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
- Detects encrypted or obfuscated .NET executables 1 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables Discord URL observed in first stage droppers 10 IoCs
- Detects executables containing URLs to raw contents of a Github gist 10 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 10 IoCs
- Detects executables packed with or use KoiVM 1 IoCs
- Detects executables referencing many varying, potentially fake Windows User-Agents 10 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 7 IoCs
- Executes dropped EXE 11 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 48 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe"C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\ayieBndRbByWcvTewT2T9FaC.exe"C:\Users\Admin\Pictures\ayieBndRbByWcvTewT2T9FaC.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u17k.0.exe"C:\Users\Admin\AppData\Local\Temp\u17k.0.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 22685⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u17k.1.exe"C:\Users\Admin\AppData\Local\Temp\u17k.1.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe"C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe"C:\Users\Admin\Pictures\eIMDy4Rn0qbzHovjZAzn3Jtp.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
-
-
-
C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe"C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe"C:\Users\Admin\Pictures\gn5aEjk7v0GI5iPeYv7I55ow.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe"C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe"C:\Users\Admin\Pictures\Nvvo3V00xwntl4w3HDd7Y2jv.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe"C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe"C:\Users\Admin\Pictures\laQmv2StdmivmKQEoXqUBnQn.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3172 -ip 31721⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
__PSScriptPolicyTest_3mhkni0x.h5e.ps1
ioloDMLog.txt
u17k.0.exe
u17k.1.exe
0gQ9iBEnHQjUSlELC7H1MAnZ.exe
ayieBndRbByWcvTewT2T9FaC.exe
eIMDy4Rn0qbzHovjZAzn3Jtp.exe
gn5aEjk7v0GI5iPeYv7I55ow.exe
qMU6YU1TvUaAsisVB8bNTl36.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
memory/1076-502-0x000000006F480000-0x000000006F4CC000-memory.dmp
memory/1076-503-0x000000006F4D0000-0x000000006F824000-memory.dmp
memory/1076-488-0x00000000063E0000-0x0000000006734000-memory.dmp
memory/1404-566-0x000000006F480000-0x000000006F4CC000-memory.dmp
memory/1404-567-0x000000006F690000-0x000000006F9E4000-memory.dmp
memory/1432-609-0x000000006F480000-0x000000006F7D4000-memory.dmp
memory/1432-619-0x0000000007980000-0x0000000007A23000-memory.dmp
memory/1432-623-0x0000000006560000-0x0000000006574000-memory.dmp
memory/1432-608-0x000000006F3A0000-0x000000006F3EC000-memory.dmp
memory/1432-595-0x00000000060B0000-0x0000000006404000-memory.dmp
memory/1432-607-0x0000000006780000-0x00000000067CC000-memory.dmp
memory/1568-142-0x0000000000400000-0x0000000002B1E000-memory.dmp
memory/1568-276-0x0000000000400000-0x0000000002B1E000-memory.dmp
memory/1624-620-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/1916-403-0x0000000005F30000-0x0000000005F7C000-memory.dmp
memory/1916-445-0x00000000074C0000-0x00000000074D4000-memory.dmp
memory/1916-392-0x00000000059C0000-0x0000000005D14000-memory.dmp
memory/1916-434-0x0000000007470000-0x0000000007481000-memory.dmp
memory/1916-422-0x000000006F480000-0x000000006F4CC000-memory.dmp
memory/1916-423-0x000000006F4F0000-0x000000006F844000-memory.dmp
memory/1916-433-0x00000000071A0000-0x0000000007243000-memory.dmp
memory/1940-307-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1940-294-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2508-213-0x00000000062B0000-0x00000000062FC000-memory.dmp
memory/2508-645-0x000000006FAB0000-0x000000006FAFC000-memory.dmp
memory/2508-236-0x0000000005B30000-0x0000000005B44000-memory.dmp
memory/2508-226-0x0000000007460000-0x0000000007471000-memory.dmp
memory/2508-644-0x0000000006C40000-0x0000000006C8C000-memory.dmp
memory/2508-215-0x000000006FC50000-0x000000006FFA4000-memory.dmp
memory/2508-225-0x0000000007320000-0x00000000073C3000-memory.dmp
memory/2508-214-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/2996-499-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/2996-586-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/3172-438-0x0000000000400000-0x0000000002AF1000-memory.dmp
memory/3172-565-0x0000000000400000-0x0000000002AF1000-memory.dmp
memory/3172-360-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3172-622-0x0000000000400000-0x0000000002AF1000-memory.dmp
memory/3244-310-0x0000021AF3120000-0x0000021AF6954000-memory.dmp
memory/3244-327-0x0000021AFD9F0000-0x0000021AFDA28000-memory.dmp
memory/3244-343-0x0000021AF8DA0000-0x0000021AF8EBF000-memory.dmp
memory/3244-338-0x0000021AFDA30000-0x0000021AFDA4E000-memory.dmp
memory/3244-337-0x0000021AFDEF0000-0x0000021AFDF66000-memory.dmp
memory/3244-336-0x0000021A98B80000-0x0000021A98B8C000-memory.dmp
memory/3244-333-0x0000021A992C0000-0x0000021A997E8000-memory.dmp
memory/3244-330-0x0000021A98D80000-0x0000021A98D8A000-memory.dmp
memory/3244-331-0x0000021A98B00000-0x0000021A98B62000-memory.dmp
memory/3244-332-0x0000021A98B60000-0x0000021A98B82000-memory.dmp
memory/3244-328-0x0000021AFD330000-0x0000021AFD33E000-memory.dmp
memory/3244-311-0x0000021AF9460000-0x0000021AF956A000-memory.dmp
memory/3244-313-0x0000021AF8EF0000-0x0000021AF8EFC000-memory.dmp
memory/3244-315-0x0000021AF8F40000-0x0000021AF8F64000-memory.dmp
memory/3244-314-0x0000021AF8EE0000-0x0000021AF8EF4000-memory.dmp
memory/3244-312-0x0000021AF86C0000-0x0000021AF86D0000-memory.dmp
memory/3244-316-0x0000021AF8F60000-0x0000021AF8F6A000-memory.dmp
memory/3244-317-0x0000021AF8F90000-0x0000021AF9042000-memory.dmp
memory/3244-318-0x0000021AF9360000-0x0000021AF938A000-memory.dmp
memory/3244-319-0x0000021AF93E0000-0x0000021AF9430000-memory.dmp
memory/3244-320-0x0000021AF8F80000-0x0000021AF8F8A000-memory.dmp
memory/3244-324-0x0000021AF96E0000-0x0000021AF99E0000-memory.dmp
memory/3244-326-0x0000021AFD320000-0x0000021AFD328000-memory.dmp
memory/3244-329-0x0000021AFD340000-0x0000021AFD348000-memory.dmp
memory/3256-239-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/3256-211-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/3436-241-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/3436-242-0x000000006FC50000-0x000000006FFA4000-memory.dmp
memory/3820-15-0x0000000074DFE000-0x0000000074DFF000-memory.dmp
memory/3820-4-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3820-115-0x0000000074DFE000-0x0000000074DFF000-memory.dmp
memory/3868-463-0x000000006F480000-0x000000006F4CC000-memory.dmp
memory/3868-464-0x000000006F4F0000-0x000000006F844000-memory.dmp
memory/3872-148-0x00000000077E0000-0x0000000007812000-memory.dmp
memory/3872-173-0x0000000007930000-0x000000000793A000-memory.dmp
memory/3872-190-0x00000000079D0000-0x00000000079D8000-memory.dmp
memory/3872-162-0x0000000007820000-0x000000000783E000-memory.dmp
memory/3872-140-0x0000000006280000-0x000000000629E000-memory.dmp
memory/3872-151-0x000000006FC50000-0x000000006FFA4000-memory.dmp
memory/3872-149-0x000000006FA80000-0x000000006FACC000-memory.dmp
memory/3872-118-0x00000000053B0000-0x00000000053D2000-memory.dmp
memory/3872-189-0x0000000007A90000-0x0000000007AAA000-memory.dmp
memory/3872-120-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/3872-188-0x00000000079A0000-0x00000000079B4000-memory.dmp
memory/3872-172-0x0000000007840000-0x00000000078E3000-memory.dmp
memory/3872-141-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/3872-119-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/3872-133-0x0000000005C80000-0x0000000005FD4000-memory.dmp
memory/3872-145-0x0000000007620000-0x000000000763A000-memory.dmp
memory/3908-255-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/4260-208-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/4280-209-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/4492-156-0x000000006FC50000-0x000000006FFA4000-memory.dmp
memory/4492-182-0x0000000007DC0000-0x0000000007E56000-memory.dmp
memory/4492-150-0x000000006FA80000-0x000000006FACC000-memory.dmp
memory/4492-116-0x0000000003060000-0x0000000003096000-memory.dmp
memory/4492-187-0x0000000007D60000-0x0000000007D6E000-memory.dmp
memory/4492-117-0x0000000005950000-0x0000000005F78000-memory.dmp
memory/4492-143-0x0000000006B20000-0x0000000006B64000-memory.dmp
memory/4492-183-0x0000000007D20000-0x0000000007D31000-memory.dmp
memory/4492-144-0x0000000007750000-0x00000000077C6000-memory.dmp
memory/4492-146-0x0000000008050000-0x00000000086CA000-memory.dmp
memory/4540-17-0x0000022CA21C0000-0x0000022CA21D0000-memory.dmp
memory/4540-18-0x0000022CA23D0000-0x0000022CA23F2000-memory.dmp
memory/4540-21-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp
memory/4540-16-0x0000022CA21C0000-0x0000022CA21D0000-memory.dmp
memory/4540-14-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp
memory/4692-1-0x00007FFD234B3000-0x00007FFD234B5000-memory.dmp
memory/4692-22-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp
memory/4692-3-0x00007FFD234B0000-0x00007FFD23F71000-memory.dmp
memory/4692-2-0x000001C273F70000-0x000001C273FCE000-memory.dmp
memory/4692-0-0x000001C271B40000-0x000001C271B4A000-memory.dmp
memory/4972-514-0x000000006F4D0000-0x000000006F824000-memory.dmp
memory/4972-513-0x000000006F480000-0x000000006F4CC000-memory.dmp
memory/5052-554-0x000000006F690000-0x000000006F9E4000-memory.dmp
memory/5052-552-0x000000006F480000-0x000000006F4CC000-memory.dmp
memory/5052-531-0x0000000005BA0000-0x0000000005EF4000-memory.dmp
memory/5080-584-0x0000000000400000-0x0000000002ED5000-memory.dmp
memory/5080-500-0x0000000000400000-0x0000000002ED5000-memory.dmp