Analysis
- user interaction
yes - max time kernel
600s - max time network
613s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/07/2026, 15:01
General
- Target gmail-account-creator-x64.exe
- Size 78.2MB
- Sample260710-sd5vgabv9l
- SHA256 ba5be09836c1061bb64f558f8614c1bb463276a026252937c9bdf2d06a530dc5
Malware Config
Extracted
-
ghostsocks
-
https://147.45.197.92:443
-
https://194.28.225.230:443
-
https://94.228.161.88:443
Signatures
- Family: GhostSocks
GhostSocks is a proxy malware written in Golang.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Enumerates VirtualBox DLL files 2 TTPs 10 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VirtualBox drivers on disk 2 TTPs 8 IoCs
- Looks for VirtualBox executables on disk 2 TTPs 3 IoCs
- Looks for VMWare Tools registry key 2 TTPs 3 IoCs
- Looks for VMWare drivers on disk 2 TTPs 4 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 6 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Drops startup file 1 IoCs
- Executes dropped EXE 27 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry 2 TTPs 3 IoCs
System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 16 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 8 IoCs
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Modifies registry key 1 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 41 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\gmail-account-creator-x64.exe"C:\Users\Admin\AppData\Local\Temp\gmail-account-creator-x64.exe"1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"ipconfig"2⤵
- Gathers network information
-
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH2⤵
-
-
C:\Users\Public\Documents\SystemHelper\DeviceModule\cloude_edge.exe"C:\Users\Public\Documents\SystemHelper\DeviceModule\cloude_edge.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN DriverUpdateSvc3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN DriverUpdateSvc /TR C:\ProgramData\gemini\genodeb.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN IntelGraphicsHost3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN IntelGraphicsHost /TR C:\ProgramData\nodes\GeminiService.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:003⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneSync.exe'; $Shortcut.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN ChromeUpdateSvc3⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN ChromeUpdateSvc /TR C:\ProgramData\Graphics\GraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Public\Music\ServiceController\GraphicsHelper\virtual_protocol.exe"C:\Users\Public\Music\ServiceController\GraphicsHelper\virtual_protocol.exe"2⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox executables on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Public\Pictures\SystemService\SystemAdapter\SkyBridge.exe"C:\Users\Public\Pictures\SystemService\SystemAdapter\SkyBridge.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"ipconfig"3⤵
- Gathers network information
-
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH3⤵
-
-
-
C:\Users\Public\Music\WindowsHelper\SecurityHelper\DeltaNet.exe"C:\Users\Public\Music\WindowsHelper\SecurityHelper\DeltaNet.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Users\Public\Pictures\GraphicsMonitor\USBSupport\serveless.exe"C:\Users\Public\Pictures\GraphicsMonitor\USBSupport\serveless.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Looks for VMWare drivers on disk
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"ipconfig"3⤵
- Gathers network information
-
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Users\Public\Pictures\USBModule\GraphicsModule\node_ipsec.exe"C:\Users\Public\Pictures\USBModule\GraphicsModule\node_ipsec.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=570013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=570013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=570023⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=570023⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=560013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=560013⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /F /SC ONLOGON /TN DataPruneJob /TR C:\Users\Public\Pictures\USBModule\GraphicsModule\node_ipsec.exe /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MetricsAgentSvc /t REG_SZ /d C:\Users\Public\Pictures\USBModule\GraphicsModule\node_ipsec.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
C:\Users\Public\Videos\IntelUpdater\DisplayHelper\vsghssl.exe"C:\Users\Public\Videos\IntelUpdater\DisplayHelper\vsghssl.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SyncCoordinator /t REG_SZ /d C:\Users\Admin\AppData\Local\DataCache\content_helper.exe /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Create /F /SC DAILY /ST 14:18 /TN WorkspaceMaintenance /TR C:\Users\Admin\AppData\Roaming\SessionData\bg_runner.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Public\Documents\WindowsMonitor\SystemComponent\audioconfig.exe"C:\Users\Public\Documents\WindowsMonitor\SystemComponent\audioconfig.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Users\Public\Documents\SystemHelper\DeviceModule\cloude_edge.exeC:\Users\Public\Documents\SystemHelper\DeviceModule\cloude_edge.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\gemini\genodeb.exeC:\ProgramData\gemini\genodeb.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\nodes\geminsync.exeC:\ProgramData\nodes\geminsync.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\nodes\GeminiService.exeC:\ProgramData\nodes\GeminiService.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\OneSync.exeC:\Users\Public\OneSync.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\Graphics\GraphicsHost.exeC:\ProgramData\Graphics\GraphicsHost.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\ngrok\ngrok-daemon.exeC:\Users\Public\ngrok\ngrok-daemon.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\SQLite\sqlite-host.exeC:\Users\Public\SQLite\sqlite-host.exe1⤵
- Executes dropped EXE
-
C:\Users\Public\Pictures\GraphicsMonitor\USBSupport\serveless.exeC:\Users\Public\Pictures\GraphicsMonitor\USBSupport\serveless.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Nmap\ncat-daemon.exe"C:\Program Files\Nmap\ncat-daemon.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files\Chef\chef-client-service.exe"C:\Program Files\Chef\chef-client-service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\osquery\osqueryd.exe"C:\Program Files\osquery\osqueryd.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\PROGRA~1\Nginx\nginx-service.exeC:\PROGRA~1\Nginx\NGINX-~1.EXE1⤵
- Executes dropped EXE
-
C:\PROGRA~1\MOZILL~1\firefox-service.exeC:\PROGRA~1\MOZILL~1\FIREFO~1.EXE1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Public\Videos\INTELU~1\DISPLA~1\vsghssl.exeC:\Users\Public\Videos\INTELU~1\DISPLA~1\vsghssl.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\DataCache\content_helper.exeC:\Users\Admin\AppData\Local\DataCache\content_helper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\SessionData\bg_runner.exeC:\Users\Admin\AppData\Roaming\SessionData\bg_runner.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /Query /TN WorkspaceMaintenance2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Public\Pictures\USBModule\GraphicsModule\node_ipsec.exeC:\Users\Public\Pictures\USBModule\GraphicsModule\node_ipsec.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Virtualization/Sandbox Evasion
8Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
8TSPPd2keSCwph3a9tzZG
__PSScriptPolicyTest_tbgkdusu.xyo.ps1
gmmQPdDLIT0br9CyRBd7drJC3L
system_log.txt
upd152b_log.txt
ProfileMgr.lnk
config_helper.exe
.test_write_access
cloude_edge.exe
audioconfig.exe
virtual_protocol.exe
DeltaNet.exe
serveless.exe
SkyBridge.exe
vsghssl.exe
memory/1960-0-0x0000013AFC890000-0x0000013AFC891000-memory.dmp
memory/1960-2-0x0000013AFC890000-0x0000013AFC891000-memory.dmp
memory/1960-1-0x0000013AFC890000-0x0000013AFC891000-memory.dmp
memory/2456-117-0x0000000005A70000-0x000000000601C000-memory.dmp
memory/2456-116-0x0000000005A70000-0x000000000601C000-memory.dmp
memory/2456-115-0x0000000005A70000-0x000000000601C000-memory.dmp
memory/2456-109-0x0000000005A70000-0x000000000601C000-memory.dmp
memory/4912-214-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-184-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-210-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-208-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-246-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-244-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-242-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-240-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-238-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-236-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-234-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-232-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-230-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-228-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-226-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-224-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-222-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-220-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-218-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-216-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-138-0x000001FF51490000-0x000001FF5156C000-memory.dmp
memory/4912-206-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-204-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-200-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-198-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-196-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-194-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-192-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-190-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-188-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-186-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-212-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-182-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-178-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-174-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-173-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-170-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-168-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-166-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-164-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-162-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-158-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-156-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-155-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-152-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-146-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-148-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-144-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-142-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-140-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-139-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-202-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-180-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-176-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-160-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-150-0x000001FF51490000-0x000001FF51566000-memory.dmp
memory/4912-2033-0x000001FF38830000-0x000001FF38836000-memory.dmp
memory/4912-137-0x000001FF51430000-0x000001FF51494000-memory.dmp
memory/4912-136-0x000001FF51280000-0x000001FF5132E000-memory.dmp
memory/5844-59-0x00000197E1F10000-0x00000197E1F26000-memory.dmp
memory/5844-53-0x00000197E1F40000-0x00000197E1F62000-memory.dmp
memory/6092-118-0x0000000140000000-0x00000001409AA000-memory.dmp