Analysis
- max time kernel
8s - max time network
168s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
05/11/2024, 03:18
General
- Target 31.exe
- Size 12.5MB
- Sample241105-dtxrgatbpg
- SHA256 7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
Malware Config
Extracted
-
formbook
-
4.0
-
w9z
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
Extracted
-
gozi
-
build
300869
-
exe_type
loader
Extracted
-
gozi
-
86920224
-
https://sibelikinciel.xyz
-
build
300869
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Extracted
-
qakbot
-
324.141
-
spx129
-
1590734339
-
94.10.81.239:443
-
94.52.160.116:443
-
67.0.74.119:443
-
175.137.136.79:443
-
73.232.165.200:995
-
79.119.67.149:443
-
62.38.111.70:2222
-
108.58.9.238:993
-
216.110.249.252:2222
-
67.209.195.198:3389
-
84.247.55.190:443
-
96.37.137.42:443
-
94.176.220.76:2222
-
173.245.152.231:443
-
96.227.122.123:443
-
188.192.75.8:995
-
24.229.245.124:995
-
71.163.225.75:443
-
75.71.77.59:443
-
104.36.135.227:443
Extracted
-
formbook
-
4.1
-
i0qi
-
mytakeawaybox.com
-
goutaihuo.com
-
kuzey.site
-
uppertenpiercings.amsterdam
-
honeygrandpa.com
-
jenniferabramslaw.com
-
ncarian.com
-
heavilymeditatedhouston.com
-
gsbjyzx.com
-
akisanblog.com
-
taoyuanreed.com
-
jasperrvservices.com
-
yabbanet.com
-
myhealthfuldiet.com
-
flipdigitalcoins.com
-
toes.photos
-
shoottillyoumiss.com
-
maserental.com
-
smarteacher.net
-
hamdimagdeco.com
Extracted
-
danabot
-
92.204.160.54
-
2.56.213.179
-
45.153.186.47
-
93.115.21.29
-
185.45.193.50
-
193.34.166.247
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot family
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Dharma family
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Gozi family
- Qakbot family
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V1 payload 3 IoCs
- Raccoon family
- AgentTesla payload 8 IoCs
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Formbook payload 3 IoCs
- ReZer0 packer 3 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Drops startup file 1 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: CmdExeWriteProcessMemorySpam 19 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31.exe"C:\Users\Admin\AppData\Local\Temp\31.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1BCA.tmp\1BCB.tmp\1BCC.bat C:\Users\Admin\AppData\Local\Temp\31.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\4.exeC:\Users\Admin\AppData\Roaming\4.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@13045⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f06⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\5.exeC:\Users\Admin\AppData\Roaming\5.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\6.exeC:\Users\Admin\AppData\Roaming\6.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\8.exeC:\Users\Admin\AppData\Roaming\8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\9.exeC:\Users\Admin\AppData\Roaming\9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B5.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\10.exeC:\Users\Admin\AppData\Roaming\10.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\11.exeC:\Users\Admin\AppData\Roaming\11.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp931B.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\14.exeC:\Users\Admin\AppData\Roaming\14.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\16.exeC:\Users\Admin\AppData\Roaming\16.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Roaming\17.exeC:\Users\Admin\AppData\Roaming\17.exe4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\18.exeC:\Users\Admin\AppData\Roaming\18.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe4⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe4⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\AppData\Roaming\21.exeC:\Users\Admin\AppData\Roaming\21.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4805⤵
-
-
-
C:\Users\Admin\AppData\Roaming\22.exeC:\Users\Admin\AppData\Roaming\22.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\23.exeC:\Users\Admin\AppData\Roaming\23.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\24.exeC:\Users\Admin\AppData\Roaming\24.exe4⤵
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\25.exeC:\Users\Admin\AppData\Roaming\25.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\26.exeC:\Users\Admin\AppData\Roaming\26.exe4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp982.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe4⤵
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /C5⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igljhi\beiolz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igljhi\beiolz.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igljhi\beiolz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igljhi\beiolz.exe /C6⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aevudus /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I aevudus" /SC ONCE /Z /ST 03:24 /ET 03:365⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\29.exeC:\Users\Admin\AppData\Roaming\29.exe4⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@29525⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f06⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\30.exeC:\Users\Admin\AppData\Roaming\30.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\31.exeC:\Users\Admin\AppData\Roaming\31.exe4⤵
-
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\18.exe"3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\11.exe"3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
OWOW64WW.cab.id-072A6AE9.[[email protected]].BOMBO
1BCC.bat
1.jar
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
16.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
26.exe
27.exe
28.exe
29.exe
3.exe
30.exe
31.exe
4.exe
5.exe
6.exe
7.exe
8.exe
9.exe
index.html
license
license
memory/236-1160-0x0000000000400000-0x0000000002DF6000-memory.dmp
memory/592-152-0x0000000000950000-0x00000000009FC000-memory.dmp
memory/592-10373-0x0000000000410000-0x0000000000418000-memory.dmp
memory/592-8233-0x0000000000400000-0x0000000000408000-memory.dmp
memory/592-1539-0x0000000000280000-0x0000000000294000-memory.dmp
memory/592-1540-0x0000000000290000-0x0000000000298000-memory.dmp
memory/1220-1145-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1264-2117-0x00000000077E0000-0x0000000007922000-memory.dmp
memory/1264-114-0x00000000003C0000-0x00000000004C0000-memory.dmp
memory/1304-219-0x0000000003570000-0x00000000037E7000-memory.dmp
memory/1304-980-0x0000000000400000-0x000000000300E000-memory.dmp
memory/1304-631-0x0000000000400000-0x000000000300E000-memory.dmp
memory/1304-364-0x0000000000400000-0x000000000300E000-memory.dmp
memory/1304-1118-0x0000000000400000-0x000000000300E000-memory.dmp
memory/1384-109-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/1408-3099-0x0000000000400000-0x0000000000452000-memory.dmp
memory/1524-124-0x0000000000280000-0x0000000000290000-memory.dmp
memory/1524-374-0x0000000000400000-0x0000000000439000-memory.dmp
memory/1592-620-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/1600-161-0x0000000000F70000-0x0000000000FDE000-memory.dmp
memory/1600-752-0x0000000000730000-0x0000000000770000-memory.dmp
memory/1600-743-0x0000000000C70000-0x0000000000CC2000-memory.dmp
memory/1600-1043-0x0000000000910000-0x000000000093D000-memory.dmp
memory/1720-632-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1720-695-0x0000000000DB0000-0x0000000000E06000-memory.dmp
memory/1720-249-0x0000000001130000-0x00000000011C8000-memory.dmp
memory/1728-148-0x0000000000140000-0x000000000015A000-memory.dmp
memory/2120-633-0x0000000000400000-0x0000000002DF6000-memory.dmp
memory/2284-365-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/2444-694-0x0000000004900000-0x0000000004958000-memory.dmp
memory/2444-253-0x00000000001F0000-0x000000000025A000-memory.dmp
memory/2592-1166-0x0000000001FF0000-0x000000000225B000-memory.dmp
memory/2636-690-0x000000000D990000-0x000000000DB2A000-memory.dmp
memory/2636-256-0x0000000000B40000-0x0000000000CC4000-memory.dmp
memory/2636-593-0x00000000002F0000-0x00000000002F6000-memory.dmp
memory/2636-749-0x00000000003A0000-0x00000000003A6000-memory.dmp
memory/2840-651-0x0000000000400000-0x0000000002DE1000-memory.dmp
memory/2952-696-0x0000000003580000-0x00000000037F7000-memory.dmp
memory/2952-1790-0x0000000000400000-0x000000000301E000-memory.dmp
memory/2952-1143-0x0000000000400000-0x000000000301E000-memory.dmp
memory/2972-6076-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3056-693-0x0000000000C40000-0x0000000000C98000-memory.dmp
memory/3056-157-0x0000000001070000-0x000000000112E000-memory.dmp
memory/3056-677-0x0000000000490000-0x0000000000498000-memory.dmp
memory/3064-105-0x0000000000400000-0x000000000042D000-memory.dmp
memory/3064-153-0x0000000000400000-0x000000000042D000-memory.dmp
memory/3064-142-0x0000000000430000-0x0000000000497000-memory.dmp
memory/3348-1648-0x0000000001EA0000-0x000000000210B000-memory.dmp
memory/3800-1139-0x0000000000090000-0x0000000000097000-memory.dmp
memory/3928-1095-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3928-1093-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3928-1097-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3928-1099-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/3928-1102-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3928-1091-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3928-1101-0x0000000000400000-0x0000000000452000-memory.dmp
memory/3928-1100-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4948-6979-0x0000000000400000-0x0000000000450000-memory.dmp