Analysis
- max time kernel
147s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
15/09/2024, 00:35
General
- Target f9982cc23128116b05f56982fe6db93b58c2903f58ed337651922f6d36b52a78.exe
- Size 1.8MB
- Sample240915-axe42swcqd
- SHA256 f9982cc23128116b05f56982fe6db93b58c2903f58ed337651922f6d36b52a78
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
redline
-
LiveTraffic
-
95.179.250.45:26212
Extracted
-
redline
-
@OLEH_PSP
-
65.21.18.51:45580
Extracted
-
stealc
-
default2
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
redline
-
bundle
-
185.215.113.67:15206
Extracted
-
stealc
-
default
-
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
-
cryptbot
-
analforeverlovyu.top
-
fivevd5sb.top
-
url_path
/v1/upload.php
Extracted
-
redline
-
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
-
91.194.55.146:29862
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detects ZharkBot payload 2 IoCs
ZharkBot is a botnet written C++.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
- ZharkBot
ZharkBot is a botnet written C++.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 4 IoCs
- Executes dropped EXE 28 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 5 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 52 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f9982cc23128116b05f56982fe6db93b58c2903f58ed337651922f6d36b52a78.exe"C:\Users\Admin\AppData\Local\Temp\f9982cc23128116b05f56982fe6db93b58c2903f58ed337651922f6d36b52a78.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\omwj3p0NVx.exe"C:\Users\Admin\AppData\Roaming\omwj3p0NVx.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Jd2sHYGTQv.exe"C:\Users\Admin\AppData\Roaming\Jd2sHYGTQv.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000284001\acentric.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"5⤵
-
-
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000351001\4538257034.exe"C:\Users\Admin\AppData\Local\Temp\1000351001\4538257034.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1000356001\BowExpert.exe"C:\Users\Admin\AppData\Local\Temp\1000356001\BowExpert.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Luck Luck.bat & Luck.bat & exit7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6841268⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "VegetablesIndividualBindingGba" Ever8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Wire + ..\Qualified + ..\Manufacturers + ..\Wesley + ..\Haiti + ..\Done + ..\Drop + ..\Runner + ..\Defend + ..\Judy + ..\Dow C8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\684126\Intake.pifIntake.pif C8⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\684126\RegAsm.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 58⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000285001\2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 4206⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"C:\Users\Admin\AppData\Local\Temp\1000287001\splwow64.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 6076986⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "MaskBathroomCompositionInjection" Participants6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\607698\Waters.pifWaters.pif Q6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 56⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Additionally" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & echo URL="C:\Users\Admin\AppData\Local\SecureData Technologies\TurtleHarbor.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TurtleHarbor.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3368 -ip 33681⤵
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
gold.exe
crypteda.exe
Nework.exe
stealc_default2.exe
2.exe
needmoney.exe
penis.exe
bundle.exe
acentric.exe
2.exe
splwow64.exe
crypted.exe
xclient.exe
BowExpert.exe
axplong.exe
Q
Waters.pif
707477581343
Asbestos
Ashley
Bet
Emotions
Ensures
Fla
Language
Navy
Participants
Rick
Streaming
Temperature
Tmp9D88.tmp
Viruses
Width
svchost015.exe
Jd2sHYGTQv.exe
76b53b3ec448f7ccdda2063b15d2bfc3_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8
d3d9.dll
omwj3p0NVx.exe
Microsoft Edge.lnk
Google Chrome.lnk
memory/8-4-0x0000000000920000-0x0000000000DEC000-memory.dmp
memory/8-16-0x0000000000920000-0x0000000000DEC000-memory.dmp
memory/8-1-0x0000000077436000-0x0000000077438000-memory.dmp
memory/8-3-0x0000000000920000-0x0000000000DEC000-memory.dmp
memory/8-2-0x0000000000921000-0x000000000094F000-memory.dmp
memory/8-0-0x0000000000920000-0x0000000000DEC000-memory.dmp
memory/1032-307-0x0000000000B40000-0x0000000000BC0000-memory.dmp
memory/1188-394-0x0000000000970000-0x0000000000A1E000-memory.dmp
memory/1596-460-0x0000000000D20000-0x0000000000D74000-memory.dmp
memory/2040-326-0x0000000000DC0000-0x0000000000E12000-memory.dmp
memory/2076-515-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2076-518-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-23-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-19-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-538-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-345-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-198-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-213-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-17-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-209-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-557-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-512-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-254-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-665-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-678-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-20-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-548-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-21-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2244-22-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/2896-81-0x0000000007110000-0x000000000714C000-memory.dmp
memory/2896-66-0x0000000006120000-0x0000000006196000-memory.dmp
memory/2896-80-0x00000000070B0000-0x00000000070C2000-memory.dmp
memory/2896-46-0x0000000000400000-0x0000000000452000-memory.dmp
memory/2896-86-0x0000000008A50000-0x0000000008A9C000-memory.dmp
memory/2896-79-0x0000000008940000-0x0000000008A4A000-memory.dmp
memory/2896-49-0x00000000059B0000-0x0000000005F56000-memory.dmp
memory/2896-50-0x0000000005500000-0x0000000005592000-memory.dmp
memory/2896-78-0x0000000007180000-0x0000000007798000-memory.dmp
memory/2896-67-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/2896-51-0x00000000056A0000-0x00000000056AA000-memory.dmp
memory/3056-463-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3252-556-0x000000006BAB0000-0x000000006BBEC000-memory.dmp
memory/3252-555-0x0000000000E10000-0x0000000000E21000-memory.dmp
memory/3280-251-0x0000000000210000-0x0000000000453000-memory.dmp
memory/3280-175-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3280-174-0x0000000000210000-0x0000000000453000-memory.dmp
memory/3368-401-0x0000000000400000-0x0000000000454000-memory.dmp
memory/3368-403-0x0000000000400000-0x0000000000454000-memory.dmp
memory/3544-485-0x0000000006BD0000-0x0000000006BEA000-memory.dmp
memory/3544-375-0x0000000000FE0000-0x0000000001058000-memory.dmp
memory/3552-521-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3552-404-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3552-547-0x0000000000400000-0x000000000106F000-memory.dmp
memory/3596-576-0x00000000006E0000-0x0000000000BAC000-memory.dmp
memory/3596-575-0x00000000006E0000-0x0000000000BAC000-memory.dmp
memory/4132-352-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4132-374-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4132-348-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4132-351-0x0000000000400000-0x0000000000643000-memory.dmp
memory/4244-609-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-635-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-650-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-644-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-526-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-626-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-618-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-601-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-592-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-523-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-525-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-574-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4244-568-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4472-684-0x0000000000890000-0x0000000000D5C000-memory.dmp
memory/4616-353-0x0000000000400000-0x000000000081B000-memory.dmp
memory/4780-113-0x0000000000470000-0x00000000004C2000-memory.dmp
memory/4780-247-0x00000000076E0000-0x00000000078A2000-memory.dmp
memory/4780-248-0x0000000007DE0000-0x000000000830C000-memory.dmp
memory/4780-214-0x00000000067A0000-0x0000000006806000-memory.dmp
memory/4780-249-0x00000000078B0000-0x0000000007900000-memory.dmp
memory/4800-554-0x00000000040E0000-0x0000000004151000-memory.dmp
memory/4800-551-0x00000000040E0000-0x0000000004151000-memory.dmp
memory/4800-550-0x00000000040E0000-0x0000000004151000-memory.dmp
memory/4800-552-0x00000000040E0000-0x0000000004151000-memory.dmp
memory/4800-549-0x00000000040E0000-0x0000000004151000-memory.dmp
memory/4800-553-0x00000000040E0000-0x0000000004151000-memory.dmp
memory/4840-691-0x00000000007B0000-0x000000000083C000-memory.dmp
memory/4992-112-0x0000000000E00000-0x0000000000EA2000-memory.dmp
memory/5036-43-0x0000000000330000-0x0000000000384000-memory.dmp
memory/5036-42-0x0000000072DFE000-0x0000000072DFF000-memory.dmp