Analysis
- max time kernel
115s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/12/2024, 18:06
General
- Target 54f0623647c76b20c798446f1775f425c4fa1e49b912bc630a99aaf5cad759db.exe
- Size 6.8MB
- Sample241210-wp4y4askh1
- SHA256 54f0623647c76b20c798446f1775f425c4fa1e49b912bc630a99aaf5cad759db
Malware Config
Extracted
-
amadey
-
4.42
-
9c9aa5
-
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
-
lumma
-
https://impend-differ.biz/api
-
https://print-vexer.biz/api
-
https://dare-curbys.biz/api
-
https://covery-mover.biz/api
-
https://formy-spill.biz/api
-
https://dwell-exclaim.biz/api
-
https://zinc-sneark.biz/api
-
https://se-blurry.biz/api
-
https://atten-supporse.biz/api
Extracted
-
stealc
-
drum
-
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
-
stealc
-
stok
-
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
-
lumma
-
https://atten-supporse.biz/api
-
https://covery-mover.biz/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
- Gcleaner family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 16 IoCs
- Identifies Wine through registry keys 2 TTPs 12 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Windows security modification 2 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 5 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f0623647c76b20c798446f1775f425c4fa1e49b912bc630a99aaf5cad759db.exe"C:\Users\Admin\AppData\Local\Temp\54f0623647c76b20c798446f1775f425c4fa1e49b912bc630a99aaf5cad759db.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\I1h60.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\I1h60.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\M0K23.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\M0K23.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V40B6.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1V40B6.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\1013765001\yiklfON.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe"C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1013771001\3EUEYgl.exe" & rd /s /q "C:\ProgramData\UKFK6PZ58YM7" & exit7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 108⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013772001\46ccb0074e.exe"C:\Users\Admin\AppData\Local\Temp\1013772001\46ccb0074e.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1013773001\61b7d3a0f4.exe"C:\Users\Admin\AppData\Local\Temp\1013773001\61b7d3a0f4.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1013774001\f04fb79d25.exe"C:\Users\Admin\AppData\Local\Temp\1013774001\f04fb79d25.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking7⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking8⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28272204-cdce-4e89-ae4b-79c408e2a5df} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" gpu9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2492 -parentBuildID 20240401114208 -prefsHandle 2484 -prefMapHandle 2472 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61837012-ec5f-496b-ba1d-2315f020f3a0} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" socket9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3188 -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3024 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bff9ce88-6abf-497d-b7ed-4932a8787235} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" tab9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3772 -childID 2 -isForBrowser -prefsHandle 3764 -prefMapHandle 3760 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1eacb22b-3a5c-4166-8962-facfdf5a4a5d} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" tab9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4324 -prefMapHandle 4332 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98a457de-9f47-424a-9c2a-735eed717523} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" utility9⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {095cc9df-38b5-4e9e-bd10-ccb270db00f0} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" tab9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5508 -prefMapHandle 5512 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d61c53f-1136-4b0a-b50a-836f2d959183} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" tab9⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5720 -childID 5 -isForBrowser -prefsHandle 5680 -prefMapHandle 5320 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44413785-8644-46d7-ab2f-4f74098f9149} 3380 "\\.\pipe\gecko-crash-server-pipe.3380" tab9⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1013775001\332ae8b687.exe"C:\Users\Admin\AppData\Local\Temp\1013775001\332ae8b687.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1013776001\6c2ab27e2f.exe"C:\Users\Admin\AppData\Local\Temp\1013776001\6c2ab27e2f.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 7807⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2h1692.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2h1692.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3G21i.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3G21i.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4v169N.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4v169N.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exeC:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5280 -ip 52801⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
download[1].htm
activity-stream.discovery_stream.json
92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
asrouter.ftl
yiklfON.exe
3EUEYgl.exe
46ccb0074e.exe
61b7d3a0f4.exe
f04fb79d25.exe
332ae8b687.exe
6c2ab27e2f.exe
4v169N.exe
I1h60.exe
3G21i.exe
M0K23.exe
1V40B6.exe
2h1692.exe
tmpaddon
tmpaddon-1
AlternateServices.bin
AlternateServices.bin
AlternateServices.bin
data.safe.bin
data.safe.bin
data.safe.bin
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
0f97780a-2735-41b6-b736-4b79000df850
12b0c5e7-9d2a-4cde-9763-43de0bffabb8
71a3247a-0331-4291-a8ad-ecd167dcedf2
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
3870112724rsegmnoittet-es.sqlite
memory/228-35-0x0000000000D70000-0x000000000108C000-memory.dmp
memory/228-21-0x0000000000D70000-0x000000000108C000-memory.dmp
memory/940-39-0x0000000000C50000-0x00000000010DB000-memory.dmp
memory/940-40-0x0000000000C50000-0x00000000010DB000-memory.dmp
memory/2196-164-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-166-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-195-0x00000000004B0000-0x0000000000C17000-memory.dmp
memory/2196-162-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-163-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-161-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-165-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-169-0x0000000003570000-0x0000000003763000-memory.dmp
memory/2196-167-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-168-0x0000000001240000-0x00000000012A2000-memory.dmp
memory/2196-160-0x0000000003570000-0x0000000003763000-memory.dmp
memory/2196-159-0x0000000003570000-0x0000000003763000-memory.dmp
memory/2196-158-0x0000000002F80000-0x0000000003116000-memory.dmp
memory/2196-119-0x00000000004B0000-0x0000000000C17000-memory.dmp
memory/3036-93-0x0000000000A00000-0x0000000000CBC000-memory.dmp
memory/3036-48-0x0000000000A00000-0x0000000000CBC000-memory.dmp
memory/3036-50-0x0000000000A00000-0x0000000000CBC000-memory.dmp
memory/3036-51-0x0000000000A00000-0x0000000000CBC000-memory.dmp
memory/3036-87-0x0000000000A00000-0x0000000000CBC000-memory.dmp
memory/3348-139-0x0000000000050000-0x00000000006E7000-memory.dmp
memory/3348-137-0x0000000000050000-0x00000000006E7000-memory.dmp
memory/3888-118-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/3888-88-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/3932-1350-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-982-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-3294-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-3292-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-3287-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-2988-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-2157-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-1002-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-116-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-170-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-33-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-53-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/3932-57-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/4476-56-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/4476-54-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/4584-129-0x00000000001C0000-0x000000000065A000-memory.dmp
memory/4584-115-0x00000000001C0000-0x000000000065A000-memory.dmp
memory/4928-196-0x0000000000890000-0x0000000000B44000-memory.dmp
memory/4928-984-0x0000000000890000-0x0000000000B44000-memory.dmp
memory/4928-725-0x0000000000890000-0x0000000000B44000-memory.dmp
memory/4928-996-0x0000000000890000-0x0000000000B44000-memory.dmp
memory/4928-726-0x0000000000890000-0x0000000000B44000-memory.dmp
memory/4932-45-0x0000000000F80000-0x0000000001482000-memory.dmp
memory/4932-44-0x0000000000F80000-0x0000000001482000-memory.dmp
memory/5212-2033-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/5212-1994-0x0000000000190000-0x00000000004AC000-memory.dmp
memory/5280-1893-0x0000000000400000-0x0000000000C8A000-memory.dmp
memory/5280-2105-0x0000000000400000-0x0000000000C8A000-memory.dmp
memory/5280-979-0x0000000010000000-0x000000001001C000-memory.dmp
memory/5280-999-0x0000000000400000-0x0000000000C8A000-memory.dmp
memory/5280-998-0x0000000000400000-0x0000000000C8A000-memory.dmp
memory/5280-962-0x0000000000400000-0x0000000000C8A000-memory.dmp
memory/5280-1207-0x0000000000400000-0x0000000000C8A000-memory.dmp