Analysis Overview
SHA256
c8a8fe1f5af9560c5212859d4d28c9c03a19139032cecb418b704814aa1e2cdd
Threat Level: Known bad
The file 578ce6485d7bd40f7ce0750864bceec0_NeikiAnalytics was found to be: Known bad.
Malicious Activity Summary
Detects Healer an antivirus disabler dropper
Amadey
Healer
RedLine payload
Detect ZGRat V1
RedLine
ZGRat
Modifies Windows Defender Real-time Protection settings
Checks computer location settings
Executes dropped EXE
Windows security modification
Adds Run key to start application
Program crash
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-10 03:07
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-10 03:07
Reported
2024-05-10 03:10
Platform
win10v2004-20240426-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Amadey
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
ZGRat
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389714675.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ch130548.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EZ370740.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UJ561419.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389714675.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\406790475.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EZ370740.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UJ561419.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\578ce6485d7bd40f7ce0750864bceec0_NeikiAnalytics.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ch130548.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\406790475.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\578ce6485d7bd40f7ce0750864bceec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\578ce6485d7bd40f7ce0750864bceec0_NeikiAnalytics.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ch130548.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ch130548.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EZ370740.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EZ370740.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UJ561419.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UJ561419.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 804 -ip 804
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 1084
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389714675.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389714675.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\406790475.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\406790475.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb7ae701b3" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb7ae701b3" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 193.3.19.154:80 | tcp | |
| RU | 185.161.248.143:38452 | tcp | |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.15.31.184.in-addr.arpa | udp |
| RU | 185.161.248.143:38452 | tcp | |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| RU | 185.161.248.143:38452 | tcp | |
| RU | 193.3.19.154:80 | tcp | |
| RU | 185.161.248.143:38452 | tcp | |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| RU | 193.3.19.154:80 | tcp | |
| RU | 185.161.248.143:38452 | tcp | |
| RU | 193.3.19.154:80 | tcp | |
| RU | 185.161.248.143:38452 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ch130548.exe
| MD5 | c86a586be87f99e8779f161dba86c6c0 |
| SHA1 | 440be9a95549697d1e8198b3b797fb28ecb600a4 |
| SHA256 | ca832eecd2291d28808bc3112dd7d9b374b4fbc75b6b3ae2c79050fc788c924f |
| SHA512 | d991d10951ba73a8c6fa82fd930e73908dc9090422289ba3b4304762e147349e75f100fa363bd684c3b9d83f440f80679e35d9288efd383eb8ca0987ef942fb3 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EZ370740.exe
| MD5 | 004f0f3f83a34db26014cd88c2a0c502 |
| SHA1 | 4cc32450ac672c20d36444223e089a8aa72dac63 |
| SHA256 | fb9c7e35e384e79acebc8ad75a58872c90921e90a67c90600344d4cd7d0b8587 |
| SHA512 | dcd5e65c568ef56a80c7589b19ff3597da9dd91fdf52424de8bd2fd7aea1b0c27b6da85e362996e2998549b0bfa2645a171c4c829b83ce1cf6b2b87f457573cf |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UJ561419.exe
| MD5 | a8359d8478ce254cac7359a4897bc085 |
| SHA1 | 0e9eda96ff264aaf764914af178d43ec7ff8a8d4 |
| SHA256 | b0d869529396b2f8d21bd9952578dc3bd5f9ad576cd781d4643a76b947befb47 |
| SHA512 | 161dfed681f77d04f31191e8ff6017c8e643f0cb89186726a215420e60000b3e766e88cfc684dd78e0503f0964b5fcda19aa93a8b4529a1ab8b02b505caba1a7 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\111440177.exe
| MD5 | 2b71f4b18ac8214a2bff547b6ce2f64f |
| SHA1 | b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5 |
| SHA256 | f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc |
| SHA512 | 33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177 |
memory/4340-28-0x0000000000680000-0x000000000069A000-memory.dmp
memory/4340-29-0x0000000004AA0000-0x0000000005044000-memory.dmp
memory/4340-30-0x0000000002290000-0x00000000022A8000-memory.dmp
memory/4340-32-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-58-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-56-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-54-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-52-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-50-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-48-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-46-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-44-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-42-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-40-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-34-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-31-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-38-0x0000000002290000-0x00000000022A3000-memory.dmp
memory/4340-36-0x0000000002290000-0x00000000022A3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\259277208.exe
| MD5 | df36a52d14284ba2c231d1f77757beb9 |
| SHA1 | 397eab33f2d1e9ab36466d095773c9c90b9abc5d |
| SHA256 | 83f754cfac0e547dc22df3a772683c21418a3b4326b79db97e00f363bbacaa7d |
| SHA512 | 96727de9b1f864175832403de34ed39644f3003b86b4400d594efa6b13665982f124d4e458d261745a8513b31dba8110e2ba636e67bf0e8ef190f9c42f0763ae |
memory/804-92-0x0000000000400000-0x0000000002B9B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\389714675.exe
| MD5 | 1304f384653e08ae497008ff13498608 |
| SHA1 | d9a76ed63d74d4217c5027757cb9a7a0d0093080 |
| SHA256 | 2a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa |
| SHA512 | 4138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1 |
memory/804-94-0x0000000000400000-0x0000000002B9B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\406790475.exe
| MD5 | 2c1e6fabe3676ecced7db9bd8dfd84b7 |
| SHA1 | 3d25aac62b2ac232f854de33e3f6590e0f37e19a |
| SHA256 | cb451a4a403ef7390d78166e216d646424b050a91de7969f8a271cd2adc1c79d |
| SHA512 | 33b5214835b260ab161f3498d62615b70dbe3bcba19667677a274f6d8a8035e5ba9fc15503173749f07cdc54f381d8f0de277473977625581382655f7ef21d14 |
memory/4700-112-0x0000000004E00000-0x0000000004E3C000-memory.dmp
memory/4700-113-0x00000000071E0000-0x000000000721A000-memory.dmp
memory/4700-117-0x00000000071E0000-0x0000000007215000-memory.dmp
memory/4700-119-0x00000000071E0000-0x0000000007215000-memory.dmp
memory/4700-115-0x00000000071E0000-0x0000000007215000-memory.dmp
memory/4700-114-0x00000000071E0000-0x0000000007215000-memory.dmp
memory/4700-906-0x000000000A2D0000-0x000000000A8E8000-memory.dmp
memory/4700-907-0x0000000009D10000-0x0000000009D22000-memory.dmp
memory/4700-908-0x0000000009D30000-0x0000000009E3A000-memory.dmp
memory/4700-909-0x0000000009E50000-0x0000000009E8C000-memory.dmp
memory/4700-910-0x0000000004C70000-0x0000000004CBC000-memory.dmp