Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
09/10/2025, 14:55
General
- Target ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe
- Size 1.3MB
- Sample251009-san3jsvvgs
- SHA256 ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 32 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 35 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 30 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 57 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CaKZDXGBdixx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC331.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"C:\Users\Admin\AppData\Local\Temp\ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe"2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exeC:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exeC:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exeC:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exeC:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exeC:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CaKZDXGBdixx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E7B.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exeC:\Users\Admin\AppData\Roaming\CaKZDXGBdixx.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2636 2624 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2840 2836 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrome_pwa_launcher.exe
elevation_service.exe
wmpnetwk.exe
dotnet.exe
ebb88a5df7df82e25bbd75a2c65341d558adc4b7752ee74fa2a10aa6f4e6e5ce.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_50me4t2d.hvz.ps1
tmpC331.tmp
CaKZDXGBdixx.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
StructuredQuerySchema.bin
msiexec.exe
memory/388-21-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/388-19-0x0000000005540000-0x0000000005562000-memory.dmp
memory/388-1438-0x0000000007B90000-0x0000000007B98000-memory.dmp
memory/388-267-0x0000000006AA0000-0x0000000006AEC000-memory.dmp
memory/388-1326-0x0000000007A60000-0x0000000007A71000-memory.dmp
memory/388-20-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/388-1317-0x0000000007AE0000-0x0000000007B76000-memory.dmp
memory/388-266-0x0000000006500000-0x000000000651E000-memory.dmp
memory/388-1375-0x0000000007A90000-0x0000000007A9E000-memory.dmp
memory/388-1303-0x00000000078D0000-0x00000000078DA000-memory.dmp
memory/388-1282-0x0000000007850000-0x000000000786A000-memory.dmp
memory/388-1280-0x0000000007E90000-0x000000000850A000-memory.dmp
memory/388-18-0x0000000002C90000-0x0000000002CA0000-memory.dmp
memory/388-1257-0x00000000757C0000-0x000000007580C000-memory.dmp
memory/388-1264-0x0000000006B30000-0x0000000006B4E000-memory.dmp
memory/388-1410-0x0000000007BA0000-0x0000000007BBA000-memory.dmp
memory/388-1266-0x0000000007710000-0x00000000077B4000-memory.dmp
memory/388-1255-0x0000000006AF0000-0x0000000006B24000-memory.dmp
memory/388-29-0x0000000006000000-0x0000000006357000-memory.dmp
memory/388-1251-0x0000000002C90000-0x0000000002CA0000-memory.dmp
memory/388-1388-0x0000000007AA0000-0x0000000007AB5000-memory.dmp
memory/388-1252-0x0000000002C90000-0x0000000002CA0000-memory.dmp
memory/388-17-0x0000000002C90000-0x0000000002CA0000-memory.dmp
memory/492-1637-0x0000000140000000-0x00000001401F6000-memory.dmp
memory/492-1398-0x0000000140000000-0x00000001401F6000-memory.dmp
memory/900-1350-0x0000000140000000-0x0000000140169000-memory.dmp
memory/900-1599-0x0000000140000000-0x0000000140169000-memory.dmp
memory/1068-1183-0x0000000140000000-0x000000014025F000-memory.dmp
memory/1068-1315-0x0000000140000000-0x000000014025F000-memory.dmp
memory/1432-1195-0x0000000140000000-0x0000000140266000-memory.dmp
memory/1432-1330-0x0000000140000000-0x0000000140266000-memory.dmp
memory/1464-1278-0x0000000140000000-0x000000014011C000-memory.dmp
memory/1464-1423-0x0000000140000000-0x000000014011C000-memory.dmp
memory/1948-1636-0x0000000140000000-0x0000000140147000-memory.dmp
memory/1948-1385-0x0000000140000000-0x0000000140147000-memory.dmp
memory/2060-1361-0x0000000140000000-0x00000001401AD000-memory.dmp
memory/2060-1373-0x0000000140000000-0x00000001401AD000-memory.dmp
memory/2068-1253-0x0000000140000000-0x0000000140150000-memory.dmp
memory/2068-1389-0x0000000140000000-0x0000000140150000-memory.dmp
memory/2480-1771-0x0000000005CD0000-0x0000000006027000-memory.dmp
memory/2480-2888-0x0000000071200000-0x000000007124C000-memory.dmp
memory/2596-14-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/2596-15-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/2596-16-0x00000000057F0000-0x0000000005E1A000-memory.dmp
memory/2596-1224-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/2596-13-0x0000000005120000-0x0000000005156000-memory.dmp
memory/2596-1223-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/2596-1318-0x00000000757C0000-0x000000007580C000-memory.dmp
memory/2668-7-0x0000000005810000-0x0000000005820000-memory.dmp
memory/2668-6-0x0000000005770000-0x0000000005788000-memory.dmp
memory/2668-5-0x0000000005910000-0x00000000059AC000-memory.dmp
memory/2668-4-0x00000000055C0000-0x00000000055CA000-memory.dmp
memory/2668-0-0x0000000000B10000-0x0000000000C66000-memory.dmp
memory/2668-3-0x0000000005810000-0x0000000005820000-memory.dmp
memory/2668-8-0x0000000006D80000-0x0000000006F26000-memory.dmp
memory/2668-2-0x0000000005610000-0x00000000056A2000-memory.dmp
memory/2668-1-0x0000000005BC0000-0x0000000006166000-memory.dmp
memory/3016-1316-0x0000000140000000-0x0000000140149000-memory.dmp
memory/3016-1537-0x0000000140000000-0x0000000140149000-memory.dmp
memory/3400-124-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3400-1277-0x0000000140000000-0x0000000140130000-memory.dmp
memory/3400-58-0x00000000006A0000-0x0000000000700000-memory.dmp
memory/3400-51-0x00000000006A0000-0x0000000000700000-memory.dmp
memory/3552-1428-0x0000000140000000-0x00000001401C1000-memory.dmp
memory/3552-1632-0x0000000140000000-0x00000001401C1000-memory.dmp
memory/3552-1283-0x0000000140000000-0x00000001401C1000-memory.dmp
memory/3892-1225-0x0000000140000000-0x0000000140140000-memory.dmp
memory/3900-1304-0x0000000140000000-0x000000014011E000-memory.dmp
memory/3900-1490-0x0000000140000000-0x000000014011E000-memory.dmp
memory/3976-1411-0x0000000000400000-0x000000000051D000-memory.dmp
memory/3976-1265-0x0000000000400000-0x000000000051D000-memory.dmp
memory/4212-1638-0x0000000140000000-0x0000000140216000-memory.dmp
memory/4212-1412-0x0000000140000000-0x0000000140216000-memory.dmp
memory/4324-1571-0x0000000140000000-0x0000000140188000-memory.dmp
memory/4324-1339-0x0000000140000000-0x0000000140188000-memory.dmp
memory/4420-1424-0x0000000140000000-0x0000000140148000-memory.dmp
memory/4420-1639-0x0000000140000000-0x0000000140148000-memory.dmp
memory/4632-1384-0x0000000140000000-0x0000000140155000-memory.dmp
memory/4632-1229-0x0000000140000000-0x0000000140155000-memory.dmp
memory/4636-1197-0x0000000140000000-0x000000014015B000-memory.dmp
memory/4636-1212-0x0000000140000000-0x000000014015B000-memory.dmp
memory/4836-2879-0x0000000006400000-0x000000000644C000-memory.dmp
memory/4836-2880-0x0000000071200000-0x000000007124C000-memory.dmp
memory/4836-2887-0x00000000075C0000-0x0000000007664000-memory.dmp
memory/4836-2895-0x0000000007930000-0x0000000007941000-memory.dmp
memory/4836-2896-0x0000000007970000-0x0000000007985000-memory.dmp
memory/5040-135-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-75-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-141-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-143-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-137-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-95-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-145-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-147-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-149-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-91-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-151-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-153-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-89-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-155-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-87-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-97-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-157-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-159-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-162-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-163-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-85-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-1400-0x00000000074F0000-0x0000000007540000-memory.dmp
memory/5040-165-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-133-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-131-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-167-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-170-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-129-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-127-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-172-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-79-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-123-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-174-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-121-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-77-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-176-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-139-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-73-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-81-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-119-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-93-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-69-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-117-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-113-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-71-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-101-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-111-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-109-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-107-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-115-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-105-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-103-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-57-0x0000000005CC0000-0x0000000005D1A000-memory.dmp
memory/5040-49-0x0000000005C00000-0x0000000005C5C000-memory.dmp
memory/5040-36-0x0000000000400000-0x0000000000561000-memory.dmp
memory/5040-43-0x0000000002CF0000-0x0000000002D57000-memory.dmp
memory/5040-38-0x0000000002CF0000-0x0000000002D57000-memory.dmp
memory/5040-37-0x0000000000400000-0x0000000000561000-memory.dmp
memory/5040-99-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-67-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-60-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-83-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-61-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-63-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5040-65-0x0000000005CC0000-0x0000000005D14000-memory.dmp
memory/5296-1641-0x0000000140000000-0x0000000140172000-memory.dmp
memory/5296-1437-0x0000000140000000-0x0000000140172000-memory.dmp
memory/5336-736-0x0000000140000000-0x0000000140136000-memory.dmp
memory/5336-1214-0x0000000140000000-0x0000000140136000-memory.dmp
memory/5624-423-0x0000000140000000-0x0000000140130000-memory.dmp