Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
06/09/2024, 11:13
General
- Target 21d737ab11efc4ad882d6055afa369a6ceaa8affc74b6efaeeceb79c95188c7c.exe
- Size 1.8MB
- Sample240906-nbmtnatakl
- SHA256 21d737ab11efc4ad882d6055afa369a6ceaa8affc74b6efaeeceb79c95188c7c
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@CLOUDYTTEAM
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
stealc
-
default
-
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
-
redline
-
bundle
-
185.215.113.67:15206
Extracted
-
cryptbot
-
analforeverlovyu.top
-
fivev5ht.top
-
sevtv17ht.top
-
url_path
/v1/upload.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 30 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\21d737ab11efc4ad882d6055afa369a6ceaa8affc74b6efaeeceb79c95188c7c.exe"C:\Users\Admin\AppData\Local\Temp\21d737ab11efc4ad882d6055afa369a6ceaa8affc74b6efaeeceb79c95188c7c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\IbHzTQYdjc.exe"C:\Users\Admin\AppData\Roaming\IbHzTQYdjc.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jYiSUGLo0c.exe"C:\Users\Admin\AppData\Roaming\jYiSUGLo0c.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000019001\joffer2.exe"C:\Users\Admin\AppData\Local\Temp\1000019001\joffer2.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\1000238002\Amadeus.exe"C:\Users\Admin\1000238002\Amadeus.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe"C:\Users\Admin\AppData\Local\Temp\1000296001\Channel3.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F4⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe"C:\Users\Admin\AppData\Local\Temp\1000260001\5KNCHALAH.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
Amadeus.exe
gold.exe
crypteda.exe
Nework.exe
joffer2.exe
stealc_default2.exe
Sеtup.exe
needmoney.exe
runtime.exe
penis.exe
bundle.exe
5KNCHALAH.exe
Channel3.exe
axplong.exe
707477581343
Tmp9A9A.tmp
service123.exe
svchost015.exe
IbHzTQYdjc.exe
76b53b3ec448f7ccdda2063b15d2bfc3_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8
jYiSUGLo0c.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/244-379-0x0000000000A10000-0x0000000000AA0000-memory.dmp
memory/1020-121-0x00000000000B0000-0x0000000000102000-memory.dmp
memory/1036-248-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-380-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-187-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-20-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-18-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-249-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-21-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-19-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1036-188-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/1800-91-0x0000000000080000-0x0000000000192000-memory.dmp
memory/2376-331-0x0000000000990000-0x0000000000BD3000-memory.dmp
memory/2376-191-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2376-183-0x0000000000990000-0x0000000000BD3000-memory.dmp
memory/2412-123-0x00000000003B0000-0x000000000043E000-memory.dmp
memory/2412-189-0x00000000087F0000-0x0000000008856000-memory.dmp
memory/2412-236-0x000000000A120000-0x000000000A64C000-memory.dmp
memory/2412-233-0x0000000009A20000-0x0000000009BE2000-memory.dmp
memory/2776-471-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-449-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-1521-0x000002A6AEDF0000-0x000002A6AEE3C000-memory.dmp
memory/2776-1520-0x000002A6AEAF0000-0x000002A6AEB94000-memory.dmp
memory/2776-451-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-444-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-445-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-447-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-453-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-455-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-457-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-459-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-461-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-463-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-469-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-468-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-473-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-475-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-477-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-465-0x000002A6AEBC0000-0x000002A6AECE4000-memory.dmp
memory/2776-443-0x000002A6AEBC0000-0x000002A6AECEA000-memory.dmp
memory/2776-439-0x000002A694230000-0x000002A6943CA000-memory.dmp
memory/2844-418-0x0000000000400000-0x0000000001069000-memory.dmp
memory/2968-319-0x0000000000400000-0x000000000079D000-memory.dmp
memory/3144-78-0x00000000074D0000-0x00000000074E2000-memory.dmp
memory/3144-270-0x0000000009A30000-0x0000000009A80000-memory.dmp
memory/3144-65-0x0000000006C10000-0x0000000006C2E000-memory.dmp
memory/3144-69-0x0000000008D60000-0x0000000008E6A000-memory.dmp
memory/3144-64-0x00000000065A0000-0x0000000006616000-memory.dmp
memory/3144-86-0x0000000007530000-0x000000000756C000-memory.dmp
memory/3144-45-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3144-90-0x0000000008E70000-0x0000000008EBC000-memory.dmp
memory/3144-68-0x00000000075A0000-0x0000000007BB8000-memory.dmp
memory/3144-47-0x0000000005E70000-0x0000000006416000-memory.dmp
memory/3144-48-0x0000000005960000-0x00000000059F2000-memory.dmp
memory/3144-49-0x0000000005940000-0x000000000594A000-memory.dmp
memory/3904-4-0x0000000000730000-0x0000000000BF5000-memory.dmp
memory/3904-0-0x0000000000730000-0x0000000000BF5000-memory.dmp
memory/3904-3-0x0000000000730000-0x0000000000BF5000-memory.dmp
memory/3904-1-0x0000000077436000-0x0000000077438000-memory.dmp
memory/3904-2-0x0000000000731000-0x000000000075F000-memory.dmp
memory/3904-17-0x0000000000730000-0x0000000000BF5000-memory.dmp
memory/4052-43-0x0000000000C30000-0x0000000000C84000-memory.dmp
memory/4052-42-0x0000000072DFE000-0x0000000072DFF000-memory.dmp
memory/4164-419-0x0000000000400000-0x000000000106A000-memory.dmp
memory/4384-98-0x0000000000400000-0x000000000050D000-memory.dmp
memory/4384-97-0x0000000000400000-0x000000000050D000-memory.dmp
memory/4384-93-0x0000000000400000-0x000000000050D000-memory.dmp
memory/4384-95-0x0000000000400000-0x000000000050D000-memory.dmp
memory/4384-119-0x0000000000400000-0x000000000050D000-memory.dmp
memory/4488-317-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4488-321-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4488-442-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4496-420-0x0000000007130000-0x000000000717C000-memory.dmp
memory/4496-399-0x0000000000E50000-0x0000000000EA2000-memory.dmp
memory/4760-1527-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/4760-1519-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/4876-360-0x0000000000E30000-0x0000000000E42000-memory.dmp
memory/4876-1532-0x000000001BA10000-0x000000001BA94000-memory.dmp
memory/4876-1533-0x000000001C6E0000-0x000000001C750000-memory.dmp
memory/4992-1602-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/4992-1608-0x0000000000680000-0x0000000000B45000-memory.dmp
memory/5004-1614-0x000000001B550000-0x000000001B5D4000-memory.dmp
memory/5640-1636-0x0000000000680000-0x0000000000B45000-memory.dmp