Analysis
- max time kernel
292s - max time network
271s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
29/08/2024, 22:39
General
- Target 9003f2539aec75c8c89d9987623dbbcc5a45dc183c9a43be7aa2d88e735ea3e2.exe
- Size 1.8MB
- Sample240829-2k2aaswhmn
- SHA256 9003f2539aec75c8c89d9987623dbbcc5a45dc183c9a43be7aa2d88e735ea3e2
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@CLOUDYTTEAM
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
amadey
-
4.41
-
a51500
-
http://api.garageserviceoperation.com
-
install_dir
0cf505a27f
-
install_file
ednfovi.exe
-
strings_key
0044a8b8e295529eaf3743c9bc3171d2
-
url_paths
/CoreOPT/index.php
Extracted
-
lumma
-
https://abledzovmposia.shop/api
-
https://locatedblsoqp.shop/api
-
https://traineiwnqo.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detects Monster Stealer. 1 IoCs
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Monster
Monster is a Golang stealer that was discovered in 2024.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 2 IoCs
- Executes dropped EXE 26 IoCs
- Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 34 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Windows directory 9 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Modifies system certificate store 2 TTPs 5 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9003f2539aec75c8c89d9987623dbbcc5a45dc183c9a43be7aa2d88e735ea3e2.exe"C:\Users\Admin\AppData\Local\Temp\9003f2539aec75c8c89d9987623dbbcc5a45dc183c9a43be7aa2d88e735ea3e2.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WQ1P4RUvi6.exe"C:\Users\Admin\AppData\Roaming\WQ1P4RUvi6.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\fJ5ejuud1w.exe"C:\Users\Admin\AppData\Roaming\fJ5ejuud1w.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 403656⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "HopeBuildersGeniusIslam" Sonic6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pifBeijing.pif s6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000223001\openvpn12.exe"C:\Users\Admin\AppData\Local\Temp\1000223001\openvpn12.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000225001\WASSetup.exe"C:\Users\Admin\AppData\Local\Temp\1000225001\WASSetup.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000226001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000226001\build.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\onefile_3076_133694448474490509\stub.exeC:\Users\Admin\AppData\Local\Temp\1000226001\build.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name7⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"6⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
\??\c:\windows\system32\wscript.EXEc:\windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js"1⤵
-
C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.pif"C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.pif" "C:\Users\Admin\AppData\Local\NeuraMind Innovations\i"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
crypted.exe
crypteda.exe
Nework.exe
stealc_default2.exe
Set-up+%282%29.exe
runtime.exe
BitcoinCore.exe
openvpn12.exe
WASSetup.exe
build.exe
Beijing.pif
s
axplong.exe
Continue
Continues
Corresponding
Dietary
Minister
Mobile
Mr
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_sqlite3.pyd
_rust.pyd
libffi-7.dll
sqlite3.dll
Sonic
Speak
Template
Tmp77C0.tmp
Zinc
python310.dll
stub.exe
76b53b3ec448f7ccdda2063b15d2bfc3_98f325b1-1085-43b7-8e27-43d9cdb6ea3f
WQ1P4RUvi6.exe
fJ5ejuud1w.exe
Google Chrome.lnk
mozglue.dll
nss3.dll
vcruntime140.dll
memory/504-363-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/504-365-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/1464-17-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-18-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-151-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-158-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-159-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-167-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-278-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-16-0x0000000000361000-0x000000000038F000-memory.dmp
memory/1464-346-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-336-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-116-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-279-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1464-14-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1596-328-0x0000000000360000-0x0000000000817000-memory.dmp
memory/1604-31-0x0000000000CC0000-0x0000000000D14000-memory.dmp
memory/2024-301-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-338-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-337-0x0000000000400000-0x0000000000E13000-memory.dmp
memory/2024-299-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-329-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-303-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-305-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-304-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-302-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-292-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-300-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2024-298-0x0000000140000000-0x0000000140278000-memory.dmp
memory/2272-83-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2272-91-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2272-78-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2272-80-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2272-82-0x0000000000400000-0x000000000050D000-memory.dmp
memory/2592-195-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2592-277-0x0000000000B60000-0x0000000000DA3000-memory.dmp
memory/2592-152-0x0000000000B60000-0x0000000000DA3000-memory.dmp
memory/3360-39-0x0000000005670000-0x000000000567A000-memory.dmp
memory/3360-168-0x00000000095F0000-0x0000000009640000-memory.dmp
memory/3360-60-0x0000000008B40000-0x0000000008C4A000-memory.dmp
memory/3360-59-0x00000000073F0000-0x00000000079F6000-memory.dmp
memory/3360-57-0x0000000006A80000-0x0000000006A9E000-memory.dmp
memory/3360-62-0x0000000007370000-0x00000000073AE000-memory.dmp
memory/3360-63-0x0000000008C50000-0x0000000008C9B000-memory.dmp
memory/3360-56-0x0000000006370000-0x00000000063E6000-memory.dmp
memory/3360-34-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3360-37-0x0000000005CF0000-0x00000000061EE000-memory.dmp
memory/3360-61-0x0000000007310000-0x0000000007322000-memory.dmp
memory/3360-38-0x00000000056A0000-0x0000000005732000-memory.dmp
memory/3400-0-0x0000000000F30000-0x00000000013E7000-memory.dmp
memory/3400-13-0x0000000000F30000-0x00000000013E7000-memory.dmp
memory/3400-5-0x0000000000F30000-0x00000000013E7000-memory.dmp
memory/3400-3-0x0000000000F30000-0x00000000013E7000-memory.dmp
memory/3400-2-0x0000000000F31000-0x0000000000F5F000-memory.dmp
memory/3400-1-0x0000000077504000-0x0000000077505000-memory.dmp
memory/3660-483-0x0000000000360000-0x0000000000817000-memory.dmp
memory/3664-95-0x00000000009E0000-0x0000000000A32000-memory.dmp
memory/4000-153-0x0000000008BB0000-0x0000000008C16000-memory.dmp
memory/4000-157-0x0000000009F20000-0x000000000A44C000-memory.dmp
memory/4000-96-0x0000000000560000-0x00000000005EE000-memory.dmp
memory/4000-156-0x0000000009820000-0x00000000099E2000-memory.dmp
memory/4220-307-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4220-309-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4220-306-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4220-308-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4220-319-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4220-311-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4220-310-0x0000000003D10000-0x0000000003D7F000-memory.dmp
memory/4240-360-0x0000000005570000-0x000000000560C000-memory.dmp
memory/4240-362-0x0000000005550000-0x0000000005572000-memory.dmp
memory/4240-359-0x0000000000710000-0x0000000000CA8000-memory.dmp
memory/4240-361-0x0000000005880000-0x0000000005B32000-memory.dmp
memory/4240-510-0x0000000000360000-0x0000000000817000-memory.dmp
memory/4320-502-0x0000000000360000-0x0000000000817000-memory.dmp
memory/4652-518-0x0000000000360000-0x0000000000817000-memory.dmp
memory/4772-76-0x0000000000B00000-0x0000000000C12000-memory.dmp