Analysis
- max time kernel
115s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/10/2024, 19:32
General
- Target 6024d0da7125d494d79597767a29a7b5807eb50d6c68fdf64f87c104bf970256N.exe
- Size 1.8MB
- Sample241011-x9afnavanm
- SHA256 6024d0da7125d494d79597767a29a7b5807eb50d6c68fdf64f87c104bf970256
Malware Config
Extracted
-
amadey
-
4.41
-
fed3aa
-
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
-
lumma
-
https://drawwyobstacw.sbs
-
https://condifendteu.sbs
-
https://ehticsprocw.sbs
-
https://vennurviot.sbs
-
https://resinedyw.sbs
-
https://enlargkiw.sbs
-
https://allocatinow.sbs
-
https://mathcucom.sbs
Extracted
-
stealc
-
default_valenciga
-
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
-
redline
-
TG CLOUD @RLREBORN Admin @FATHEROFCARDERS
-
89.105.223.196:29862
Extracted
-
stealc
-
doma
-
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Extracted
-
amadey
-
4.41
-
1176f2
-
http://185.215.113.19
-
install_dir
417fd29867
-
install_file
ednfoki.exe
-
strings_key
183201dc3defc4394182b4bff63c4065
-
url_paths
/CoreOPT/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 26 IoCs
- Identifies Wine through registry keys 2 TTPs 11 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Kills process with taskkill 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6024d0da7125d494d79597767a29a7b5807eb50d6c68fdf64f87c104bf970256N.exe"C:\Users\Admin\AppData\Local\Temp\6024d0da7125d494d79597767a29a7b5807eb50d6c68fdf64f87c104bf970256N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 2764⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Cuj8NygSOL.exe"C:\Users\Admin\AppData\Roaming\Cuj8NygSOL.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\N6RfeJCq4n.exe"C:\Users\Admin\AppData\Roaming\N6RfeJCq4n.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 2644⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000354001\83a2ee8db5.exe"C:\Users\Admin\AppData\Local\Temp\1000354001\83a2ee8db5.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000355001\3b9905f648.exe"C:\Users\Admin\AppData\Local\Temp\1000355001\3b9905f648.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\1000350002\013d3cb457.exe"C:\Users\Admin\1000350002\013d3cb457.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000357001\f4b8d30e85.exe"C:\Users\Admin\AppData\Local\Temp\1000357001\f4b8d30e85.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe"C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start context.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\context.execontext.exe5⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "InstallUtil.exe"8⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "InstallUtil.exe"6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMAA0ADIANAAwADAAMQBcAGEAcABwAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADAANAAyADQAMAAwADEAXABhAHAAcAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABzAHEAZABxAHMAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAHMAcQBkAHEAcwBkAC4AZQB4AGUA4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3196 -ip 31961⤵
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
gold.exe
legas.exe
stealc_default2.exe
setup2.exe
JavUmar.exe
num.exe
83a2ee8db5.exe
3b9905f648.exe
f4b8d30e85.exe
MK.exe
Nework.exe
processclass.exe
splwow64.exe
app.exe
axplong.exe
878641211696
TmpAD57.tmp
__PSScriptPolicyTest_ciquis3f.ua4.ps1
Cuj8NygSOL.exe
Office Manager.url
N6RfeJCq4n.exe
memory/452-1625-0x00000000056F0000-0x0000000005D18000-memory.dmp
memory/452-1672-0x0000000007740000-0x000000000775A000-memory.dmp
memory/452-1675-0x0000000007940000-0x0000000007951000-memory.dmp
memory/452-1624-0x0000000002E10000-0x0000000002E46000-memory.dmp
memory/452-1646-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/452-1645-0x0000000006400000-0x000000000641E000-memory.dmp
memory/452-1658-0x00000000069E0000-0x0000000006A12000-memory.dmp
memory/452-1659-0x0000000073580000-0x00000000735CC000-memory.dmp
memory/452-1669-0x0000000006A20000-0x0000000006A3E000-memory.dmp
memory/452-1674-0x00000000079C0000-0x0000000007A56000-memory.dmp
memory/452-1633-0x0000000005E20000-0x0000000005E86000-memory.dmp
memory/452-1632-0x0000000005550000-0x0000000005572000-memory.dmp
memory/452-1637-0x0000000005F70000-0x00000000062C4000-memory.dmp
memory/452-1680-0x0000000007A60000-0x0000000007A68000-memory.dmp
memory/452-1670-0x0000000007610000-0x00000000076B3000-memory.dmp
memory/452-1671-0x0000000007D80000-0x00000000083FA000-memory.dmp
memory/452-1677-0x0000000007970000-0x000000000797E000-memory.dmp
memory/452-1678-0x0000000007980000-0x0000000007994000-memory.dmp
memory/452-1673-0x00000000077B0000-0x00000000077BA000-memory.dmp
memory/452-1679-0x0000000007A80000-0x0000000007A9A000-memory.dmp
memory/692-64-0x0000000000400000-0x0000000000531000-memory.dmp
memory/692-65-0x0000000000400000-0x0000000000531000-memory.dmp
memory/692-87-0x0000000000400000-0x0000000000531000-memory.dmp
memory/692-66-0x0000000000400000-0x0000000000531000-memory.dmp
memory/1236-482-0x00000000004B0000-0x0000000000900000-memory.dmp
memory/1236-485-0x00000000004B0000-0x0000000000900000-memory.dmp
memory/1236-441-0x00000000004B0000-0x0000000000900000-memory.dmp
memory/1236-443-0x00000000004B0000-0x0000000000900000-memory.dmp
memory/1236-444-0x00000000004B0000-0x0000000000900000-memory.dmp
memory/1956-3-0x0000000000460000-0x0000000000923000-memory.dmp
memory/1956-17-0x0000000000460000-0x0000000000923000-memory.dmp
memory/1956-4-0x0000000000460000-0x0000000000923000-memory.dmp
memory/1956-0-0x0000000000460000-0x0000000000923000-memory.dmp
memory/1956-2-0x0000000000461000-0x000000000048F000-memory.dmp
memory/1956-1-0x00000000773F4000-0x00000000773F6000-memory.dmp
memory/1988-472-0x0000000069CC0000-0x000000006A377000-memory.dmp
memory/1988-499-0x0000000000C80000-0x0000000001305000-memory.dmp
memory/2188-130-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2188-108-0x0000000000720000-0x0000000000981000-memory.dmp
memory/2188-413-0x0000000000720000-0x0000000000981000-memory.dmp
memory/2212-92-0x00000000002B0000-0x0000000000318000-memory.dmp
memory/2212-126-0x000000001D960000-0x000000001DA6A000-memory.dmp
memory/2212-127-0x000000001B090000-0x000000001B0A2000-memory.dmp
memory/2212-128-0x000000001B230000-0x000000001B26C000-memory.dmp
memory/2212-146-0x000000001E3B0000-0x000000001E426000-memory.dmp
memory/2212-147-0x000000001B030000-0x000000001B04E000-memory.dmp
memory/2212-182-0x000000001F530000-0x000000001FA58000-memory.dmp
memory/2348-1656-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/2348-1653-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/2896-342-0x0000000000A50000-0x0000000000CB1000-memory.dmp
memory/2896-415-0x0000000000A50000-0x0000000000CB1000-memory.dmp
memory/3032-283-0x0000000000520000-0x0000000000528000-memory.dmp
memory/3168-109-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-449-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-500-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-18-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-514-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-20-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-543-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-486-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-19-0x0000000000C91000-0x0000000000CBF000-memory.dmp
memory/3168-21-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-22-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-356-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-48-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-91-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3168-129-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/3196-305-0x0000000008A50000-0x0000000008B5A000-memory.dmp
memory/3196-300-0x00000000061A0000-0x0000000006216000-memory.dmp
memory/3196-307-0x0000000007120000-0x000000000715C000-memory.dmp
memory/3196-253-0x00000000054A0000-0x0000000005532000-memory.dmp
memory/3196-306-0x00000000070C0000-0x00000000070D2000-memory.dmp
memory/3196-304-0x00000000071D0000-0x00000000077E8000-memory.dmp
memory/3196-301-0x0000000006840000-0x000000000685E000-memory.dmp
memory/3196-309-0x0000000007160000-0x00000000071AC000-memory.dmp
memory/3196-382-0x0000000009430000-0x0000000009496000-memory.dmp
memory/3196-390-0x00000000097F0000-0x0000000009840000-memory.dmp
memory/3196-272-0x0000000005450000-0x000000000545A000-memory.dmp
memory/3196-250-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3196-392-0x000000000A310000-0x000000000A83C000-memory.dmp
memory/3196-391-0x0000000009A10000-0x0000000009BD2000-memory.dmp
memory/3316-222-0x0000000005DE0000-0x0000000006384000-memory.dmp
memory/3316-221-0x0000000000EF0000-0x0000000000F44000-memory.dmp
memory/3572-365-0x0000000000200000-0x00000000008A3000-memory.dmp
memory/3572-446-0x0000000000200000-0x00000000008A3000-memory.dmp
memory/3688-247-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/3688-224-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4368-504-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4368-511-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4368-503-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4388-43-0x0000000000367000-0x0000000000368000-memory.dmp
memory/4476-44-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4476-47-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4476-46-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4548-491-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4548-490-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4548-489-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4548-498-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4568-448-0x0000000000FE0000-0x0000000001683000-memory.dmp
memory/4568-125-0x0000000000FE0000-0x0000000001683000-memory.dmp
memory/4568-456-0x0000000000FE0000-0x0000000001683000-memory.dmp
memory/4568-344-0x0000000000FE0000-0x0000000001683000-memory.dmp
memory/4568-308-0x0000000000FE0000-0x0000000001683000-memory.dmp
memory/4660-414-0x000000000ACE0000-0x000000000AD64000-memory.dmp
memory/4660-411-0x0000000000130000-0x0000000000248000-memory.dmp
memory/4688-198-0x0000000000B90000-0x000000000104E000-memory.dmp
memory/4688-180-0x0000000000B90000-0x000000000104E000-memory.dmp
memory/4732-181-0x000000001ED20000-0x000000001EEE2000-memory.dmp
memory/4732-90-0x0000000000390000-0x000000000042C000-memory.dmp
memory/4904-1619-0x0000000007A70000-0x0000000007B16000-memory.dmp
memory/4904-536-0x0000000000880000-0x0000000001CE6000-memory.dmp
memory/4904-1683-0x0000000003D50000-0x0000000003DA4000-memory.dmp
memory/4904-544-0x0000000007870000-0x000000000799C000-memory.dmp
memory/4904-1620-0x0000000007C80000-0x0000000007CCC000-memory.dmp
memory/4908-248-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/4908-226-0x0000000000C90000-0x0000000001153000-memory.dmp
memory/4992-488-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4992-199-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4992-357-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4992-412-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4992-455-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4992-516-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/4992-501-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/5752-1687-0x0000000000400000-0x000000000045E000-memory.dmp
memory/5752-1688-0x0000000004DF0000-0x0000000004EAC000-memory.dmp
memory/6140-1657-0x0000000000BB0000-0x000000000106E000-memory.dmp
memory/6140-1652-0x0000000000BB0000-0x000000000106E000-memory.dmp