Analysis Overview
SHA256
44fb78affcf34152976fc9e2564bfdfe62d46368c853861f541d617ce5c93dfe
Threat Level: Known bad
The file Eulen.exe was found to be: Known bad.
Malicious Activity Summary
A stealer written in Python and packaged with Pyinstaller
Blankgrabber family
Command and Scripting Interpreter: PowerShell
Loads dropped DLL
UPX packed file
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-27 19:18
Signatures
A stealer written in Python and packaged with Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blankgrabber family
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-27 19:18
Reported
2024-06-27 19:19
Platform
win11-20240508-en
Max time kernel
25s
Max time network
31s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Eulen.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Eulen.exe
"C:\Users\Admin\AppData\Local\Temp\Eulen.exe"
C:\Users\Admin\AppData\Local\Temp\Eulen.exe
"C:\Users\Admin\AppData\Local\Temp\Eulen.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Eulen.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Eulen.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gstatic.com | udp |
| US | 8.8.8.8:53 | gstatic.com | udp |
| US | 8.8.8.8:53 | gstatic.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI21522\python310.dll
| MD5 | 617c7f358a7744fa767ef52e5224c9ec |
| SHA1 | 6b8974308c1a734a5cfab590205d5135c216c54d |
| SHA256 | 67ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987 |
| SHA512 | 25d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\VCRUNTIME140.dll
| MD5 | a87575e7cf8967e481241f13940ee4f7 |
| SHA1 | 879098b8a353a39e16c79e6479195d43ce98629e |
| SHA256 | ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e |
| SHA512 | e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0 |
memory/112-25-0x00007FFF2E480000-0x00007FFF2E8E3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI21522\base_library.zip
| MD5 | 0914056664e25c8ca354cff0080a06e5 |
| SHA1 | 5b27f1317af9abf4724d8a2c8a02a20b60dd30c0 |
| SHA256 | ef6549f4ce4cc039f98f4aba2951d57870f8751a7ff712242a8764f052d16624 |
| SHA512 | 2cf4720932527b8a3b538f0c117124e19f772b5dedcffdfbcf4be7c31a074bc05d9a27e582cd4fbcb3d2e150ecb28f1ca6b6c49d388f84a811de3e7d38237eaf |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_ctypes.pyd
| MD5 | 9ca880ee43fb91437d19498793311c2f |
| SHA1 | a475666edc3c18155669afdb9360f66f6267bbef |
| SHA256 | 5c885a972a841f14ccc6d81b942a5acb60df116e7b06ad8cb2385fc59a7fb18d |
| SHA512 | d20fdf32e4e678a1c113e7896494bdae604838bee47f74168012ff5031fd852a88f3d9964226f8b5217ed38fdeee2ce666ea30f7ac842bf30e7f2e2702cafc83 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\libffi-7.dll
| MD5 | 6f818913fafe8e4df7fedc46131f201f |
| SHA1 | bbb7ba3edbd4783f7f973d97b0b568cc69cadac5 |
| SHA256 | 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56 |
| SHA512 | 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\libcrypto-1_1.dll
| MD5 | 3cc020baceac3b73366002445731705a |
| SHA1 | 6d332ab68dca5c4094ed2ee3c91f8503d9522ac1 |
| SHA256 | d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8 |
| SHA512 | 1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_ssl.pyd
| MD5 | e9f1e4e988ee39cc71b48eea7a63fb86 |
| SHA1 | b853dd38b4d97d435d59df3b2691dbab7dcae9ef |
| SHA256 | d7def30d231d85044acbcf278bde64081efaccc44a885e7831512be70efd790f |
| SHA512 | c7c6707fa0cb7b4033ac2310de62d8ffdc955f7f48d0a49886ce405166fb5edfd5f9f52e4048186637e0af6a9bc8653b7f0f00b968f447b193c275265e480101 |
memory/112-48-0x00007FFF38730000-0x00007FFF3873F000-memory.dmp
memory/112-47-0x00007FFF36220000-0x00007FFF36244000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_sqlite3.pyd
| MD5 | 557a3a3a76c8bbc792901b201b0318cf |
| SHA1 | c69027bbd7460f0be4582329de768cc3c4317bb2 |
| SHA256 | 2c0b99f214e2c6c7f2a7bb81e1ec7759039308b09ca6c4e5ffa246a6afd2ba9e |
| SHA512 | cd55f0e84e752b4789114b6f1803c96882607bc49203c9f5b1a1bce7ab1576fbbd1313f60ce59d4c67ccdaa2f28d7a297294f3a3b23ed81f599c66b066144493 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_socket.pyd
| MD5 | 8acf34fc59c9715defdd5c6dd9f22803 |
| SHA1 | 73dac021792f590b32ddef5fd6707e4c26d5c1b3 |
| SHA256 | 514d22b51327e6837edaec2a27761aca535da7dd55043ea3d4e2cb8bd7d52a61 |
| SHA512 | 0932234e97a68dd5faf46a06f5aba6e85f7d2b1896606b55d8a87a9d1973961d3913a9ea1aa0b5742e9b489eafacc5f50a74b597d4edfcf6bbde5ddd94f16fa0 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_queue.pyd
| MD5 | d69381b02618505b6d2fdafb84a2686d |
| SHA1 | 7f28533d9c6141e72d17006e008e8ee5396f4940 |
| SHA256 | 007d190306e9bf4a3ed0fbd3f46c45a716210f8b3e220f76e17d6ccf8631c00c |
| SHA512 | 72e4f5734361ed428fb2c308f4c8fecae20817ee81921939736b01836627a9edafdce0e121d00d9f5ede438717384e90ee8fa6d6f0bf92a2c17985bb016397ec |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_lzma.pyd
| MD5 | 82ebacab21a375c90c2cc10a834d294b |
| SHA1 | a066b0cbc5a8d7aab0ea78faa0785a1405abb23a |
| SHA256 | 138adc9f4a7e8cb239cdcce05af832b7e2527ed29de8e3f461c9900df8b2c404 |
| SHA512 | 7f3b27f62d163126cbc23b3ac215ba9e5ebbf6769afc7d51d0db487f4b9ef9905a7180a25f6d5b80a033f1867ac6382842ce40791dd1404c8d46543bfb01cf0a |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_hashlib.pyd
| MD5 | bd72948920169b6f05b4f252b2d88460 |
| SHA1 | a830843f0b210fb3eaad7adcb764e2f124603b7d |
| SHA256 | ae2964c42e590ad1d51837dd96b747619e3ed28f35172c517d7875f4381823e3 |
| SHA512 | 0cc1de1673932af3050b870dd9bcf8c51379dfb6f66c1acce7c345531aaaacdd31b25b553c3e602b4cff0380232ff194572c9c3184fd1182c70843df44bdf56e |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_decimal.pyd
| MD5 | bc6649c56700e2969df45e3b590052cf |
| SHA1 | 8bec6d861811f02f14cc15d39a5f2f90b8428d02 |
| SHA256 | 1384008ccd60cddcc839d3f7b0fc29bcaac3a8ad6edd9058488bd8ce21d695f8 |
| SHA512 | a965247291721d1eb873f2912f79197a4488055edbab4589648f8ee5358a2fc90d44a8544efba45331c5bb937bd4fa84181ffdf48ccb86ebcb205e2e2d53440a |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\_bz2.pyd
| MD5 | 14f6cede9e0019d27c31eee3a915ef52 |
| SHA1 | 573754df8bed96146ac30634df0729d06bf6a168 |
| SHA256 | b51492a7499cc557b8d3c055966a2fb5841b35fcb7ba9ba7e7d9b029a83ee44d |
| SHA512 | a6673afd2fbed73961b222382e5e98a792b67ba67c552f771c4865345339a7952e6d468f039e4f8631f399e86b0ee920e9587a66fc1b8834c8628b9ac1e16a62 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\unicodedata.pyd
| MD5 | a44e3cc2bf01cc23cb5579b2ed9e72c6 |
| SHA1 | 6cbc24b32ff828b0bf4061566aba1e284b474558 |
| SHA256 | 5af3d3d89e0a6ba6cbae58791ec47778f2f98a0964f70d572bd91030165abb42 |
| SHA512 | 5fdd0320f6d6884e71c768f10e6e606448c21ce75209e0c81cf9737596836e9af0914abf365d54b154a0f48e66f8d25ab9463baebe9110e1bf0d550838b77171 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\sqlite3.dll
| MD5 | fc6f37d7d90f3baacc483ef2dc6f0e05 |
| SHA1 | 0c7a777afe00c9e21f408446e1b3e92cd59dbea9 |
| SHA256 | 4d5b66f7f7b0912dc954f7ab917574da8c7904f3c13ec59e81894c22ffa88631 |
| SHA512 | 74b2a9b0b4c43184f492d1a238dbf77ccca9ab29f7ab73ebf02419c66acd6952aa2318c50d3457d43ca6fe9f43957001f4b88fe9aec01be993b91189741fc85c |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\select.pyd
| MD5 | f7b1a9d9a01db7ccfe3e6aff5010af01 |
| SHA1 | 45af84436b9c2aa6bb24b583b2b4915679ae3f3f |
| SHA256 | ba793d571893b08eab1b8a250a4b7b91cb947bc7da7e44cc6aa719c5148f0cbd |
| SHA512 | cfa67c55d55df0ff5b0aab2ea594a9210a7bfc67f11550733cf655cd9eaf6fdbe48e69c229edafd58931d5c61ad9fbf30f77f4d4e19d0a61992110627e0874c1 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\libssl-1_1.dll
| MD5 | 7f77a090cb42609f2efc55ddc1ee8fd5 |
| SHA1 | ef5a128605654350a5bd17232120253194ad4c71 |
| SHA256 | 47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f |
| SHA512 | a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63 |
C:\Users\Admin\AppData\Local\Temp\_MEI21522\blank.aes
| MD5 | c765f3e3b0b491dcb37ec324f52ed8b5 |
| SHA1 | d92961238f3c741b7d3319cb1bb67609f3f6b390 |
| SHA256 | 87d868d11060ee0171f520be1c24fb206430f3934040970c449a7a8a8bcb65d3 |
| SHA512 | 2c681e211f27c68609f1237f6983b108647e6bf2c9041c96c8be5ab07bb4e0b89eda789cd7946bd3270a7c12d9ffa53dd2f339386cb7c53bee7132fd6f8e18d6 |
memory/112-54-0x00007FFF361F0000-0x00007FFF3621C000-memory.dmp
memory/112-56-0x00007FFF385C0000-0x00007FFF385D8000-memory.dmp
memory/112-59-0x00007FFF36FD0000-0x00007FFF36FEE000-memory.dmp
memory/112-60-0x00007FFF32D90000-0x00007FFF32F01000-memory.dmp
memory/112-62-0x00007FFF361D0000-0x00007FFF361E9000-memory.dmp
memory/112-64-0x00007FFF38720000-0x00007FFF3872D000-memory.dmp
memory/112-70-0x00007FFF32730000-0x00007FFF32AA7000-memory.dmp
memory/112-71-0x000002987AAD0000-0x000002987AE47000-memory.dmp
memory/112-69-0x00007FFF33370000-0x00007FFF3339E000-memory.dmp
memory/112-79-0x00007FFF2E360000-0x00007FFF2E478000-memory.dmp
memory/112-78-0x00007FFF2E480000-0x00007FFF2E8E3000-memory.dmp
memory/112-76-0x00007FFF372C0000-0x00007FFF372CD000-memory.dmp
memory/112-75-0x00007FFF361B0000-0x00007FFF361C5000-memory.dmp
memory/112-73-0x00007FFF33080000-0x00007FFF33137000-memory.dmp
memory/1600-85-0x0000018E44300000-0x0000018E44322000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cdyyp1lh.ra0.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 627073ee3ca9676911bee35548eff2b8 |
| SHA1 | 4c4b68c65e2cab9864b51167d710aa29ebdcff2e |
| SHA256 | 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c |
| SHA512 | 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 1a9fa92a4f2e2ec9e244d43a6a4f8fb9 |
| SHA1 | 9910190edfaccece1dfcc1d92e357772f5dae8f7 |
| SHA256 | 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888 |
| SHA512 | 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64 |
memory/112-102-0x00007FFF36220000-0x00007FFF36244000-memory.dmp
memory/112-103-0x00007FFF385C0000-0x00007FFF385D8000-memory.dmp
memory/112-119-0x00007FFF36FD0000-0x00007FFF36FEE000-memory.dmp
memory/112-120-0x00007FFF32D90000-0x00007FFF32F01000-memory.dmp
memory/112-115-0x00007FFF32730000-0x00007FFF32AA7000-memory.dmp
memory/112-113-0x00007FFF33370000-0x00007FFF3339E000-memory.dmp
memory/112-111-0x00007FFF361D0000-0x00007FFF361E9000-memory.dmp
memory/112-104-0x00007FFF2E480000-0x00007FFF2E8E3000-memory.dmp
memory/112-121-0x000002987AAD0000-0x000002987AE47000-memory.dmp
memory/112-122-0x00007FFF2E480000-0x00007FFF2E8E3000-memory.dmp