Malware Analysis Report

2025-01-18 16:42

Sample ID 241214-3amjtsyqbl
Target f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118
SHA256 eada68bef32929f9ba47b3f8079bb32e9f9aab10761712d22d3a7fa84d5683f8
Tags
isrstealer discovery stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eada68bef32929f9ba47b3f8079bb32e9f9aab10761712d22d3a7fa84d5683f8

Threat Level: Known bad

The file f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

isrstealer discovery stealer trojan

ISR Stealer payload

ISR Stealer

Isrstealer family

Uses the VBS compiler for execution

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-14 23:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-14 23:18

Reported

2024-12-14 23:21

Platform

win7-20240903-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Isrstealer family

isrstealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Update.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\keygen.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2484 set thread context of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\keygen.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Update.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2336 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2484 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\keygen.exe

"C:\Users\Admin\AppData\Local\Temp\keygen.exe"

C:\Users\Admin\AppData\Local\Temp\Update.exe

"C:\Users\Admin\AppData\Local\Temp\Update.exe"

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 rapidzone.in udp

Files

\Users\Admin\AppData\Local\Temp\keygen.exe

MD5 7104a4e156ec557b1a244248e24e1e11
SHA1 14ad5fe6f1bd048b143680d02952236443d81a5b
SHA256 8d8bd661b6363b13d48dbdd336bdaff9b1bbafd03b7cd24495bb9089d7138e96
SHA512 eed17a4b0864d50b305fe2bd260f97544f05d6fd7e53e9f3e944de379cf4d3821acea9f2e9e56a526537b7a48300b313e01efcefe079e7d28f73e694f7c00008

memory/2704-30-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-29-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-28-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-27-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-26-0x0000000000260000-0x00000000002AA000-memory.dmp

\Users\Admin\AppData\Local\Temp\Update.exe

MD5 57c55484129297bd7c28018d68188921
SHA1 8bc8bed5b17eb1c39b211af2672b32c85890d02f
SHA256 fd7a345b66cb1faa6b7cc92ea2f171b939d37b690ee2bdae9edcdb1d58a23651
SHA512 efdfb851f4ed86ef107cf4bb6e2755069107ef6ae4058473e80dca2e763e729dfa5d7a0b1d67bfe1d6911340f3ee8725df42910169ab13239f032d40d476e5d8

memory/2704-17-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2336-10-0x0000000002920000-0x0000000002A13000-memory.dmp

memory/2336-13-0x0000000002920000-0x0000000002A13000-memory.dmp

memory/2828-31-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2828-35-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2828-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2828-33-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2828-32-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2828-41-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2704-42-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-43-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-44-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-45-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-46-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-47-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-48-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-49-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-50-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-51-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-52-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-53-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-54-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-55-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/2704-56-0x0000000000400000-0x00000000004F3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-14 23:18

Reported

2024-12-14 23:21

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe"

Signatures

ISR Stealer

trojan stealer isrstealer

ISR Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Isrstealer family

isrstealer

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\keygen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Update.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1964 set thread context of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Update.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\keygen.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2116 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2116 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\keygen.exe
PID 2116 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2116 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 2116 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Update.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1964 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Update.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\f12f98156e5d6f72cf3f017cd192896d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\keygen.exe

"C:\Users\Admin\AppData\Local\Temp\keygen.exe"

C:\Users\Admin\AppData\Local\Temp\Update.exe

"C:\Users\Admin\AppData\Local\Temp\Update.exe"

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x308 0x408

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 rapidzone.in udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\keygen.exe

MD5 7104a4e156ec557b1a244248e24e1e11
SHA1 14ad5fe6f1bd048b143680d02952236443d81a5b
SHA256 8d8bd661b6363b13d48dbdd336bdaff9b1bbafd03b7cd24495bb9089d7138e96
SHA512 eed17a4b0864d50b305fe2bd260f97544f05d6fd7e53e9f3e944de379cf4d3821acea9f2e9e56a526537b7a48300b313e01efcefe079e7d28f73e694f7c00008

memory/1572-16-0x0000000000400000-0x00000000004F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Update.exe

MD5 57c55484129297bd7c28018d68188921
SHA1 8bc8bed5b17eb1c39b211af2672b32c85890d02f
SHA256 fd7a345b66cb1faa6b7cc92ea2f171b939d37b690ee2bdae9edcdb1d58a23651
SHA512 efdfb851f4ed86ef107cf4bb6e2755069107ef6ae4058473e80dca2e763e729dfa5d7a0b1d67bfe1d6911340f3ee8725df42910169ab13239f032d40d476e5d8

memory/1572-20-0x0000000000730000-0x000000000077A000-memory.dmp

memory/1964-21-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

memory/1964-22-0x0000000074CB0000-0x0000000075261000-memory.dmp

memory/1572-27-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-31-0x00000000007F0000-0x00000000007FC000-memory.dmp

memory/1572-32-0x0000000000401000-0x000000000041B000-memory.dmp

memory/4940-33-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4940-36-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1572-28-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-25-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-24-0x0000000000730000-0x000000000077A000-memory.dmp

memory/1964-23-0x0000000074CB0000-0x0000000075261000-memory.dmp

memory/1572-30-0x00000000007D0000-0x00000000007E0000-memory.dmp

memory/1572-29-0x00000000007C0000-0x00000000007C1000-memory.dmp

memory/1572-26-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1964-39-0x0000000074CB0000-0x0000000075261000-memory.dmp

memory/4940-41-0x0000000000400000-0x0000000000414000-memory.dmp

memory/4940-40-0x0000000000420000-0x00000000004E9000-memory.dmp

memory/1572-42-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-43-0x0000000000730000-0x000000000077A000-memory.dmp

memory/1572-44-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-45-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-46-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-47-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-48-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-49-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-50-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-51-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-52-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-53-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-54-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-55-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-56-0x0000000000400000-0x00000000004F3000-memory.dmp

memory/1572-57-0x0000000000400000-0x00000000004F3000-memory.dmp