Analysis
- max time kernel
1s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 03:53
General
- Target jaffacakes118_Camfrog Video Chat Pro 5.5.236 incl. Serial (Multi_Deutsch).exe
- Size 15.0MB
- Sample260910-efmj1sywfv
- SHA256 686016ba438739235e5098092b821130a152d7b73e1d5395b4099c3fe31c525f
Score
10/10
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Family: ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
- Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
- ISR Stealer payload 2 IoCs
- Modifies firewall policy service 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Windows security modification 2 TTPs 7 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Camfrog Video Chat Pro 5.5.236 incl. Serial (Multi_Deutsch).exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Camfrog Video Chat Pro 5.5.236 incl. Serial (Multi_Deutsch).exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Identifies Wine through registry keys
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8e6b9c188,0x7ff8e6b9c194,0x7ff8e6b9c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,4966915337744269687,12944477852846898351,262144 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,12949755139900062900,8086690488763774821,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,456613772588648449,2746272426061675776,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,752423993351894654,17016274992848041562,2097152 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,3064483919195259579,17882033432090856025,2097152 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,18010087160754454181,2028807421552738490,2097152 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,2597917616392650,15092659368755751353,2097152 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,8092171276667083281,8589289466544336507,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,15208207239970542209,11418820840027654220,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,5287576875022055903,6132282299006574528,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11836291758246816546,5017651058297466869,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11836291758246816546,5017651058297466869,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,14658651502996227379,5426250024197861402,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,14669625122102781068,16835480538487744973,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1344,i,2571360300861615083,6104749304051273725,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,7294480679279359980,9406639533463106880,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,7051504005385959065,17907109739067016645,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,4699803321545655354,4144333291561822669,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,5962608952601159097,8844833048455925333,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,10786072754732538440,13334098637633619691,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,15401262377379190880,11596803954579367075,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6960,i,5774467919736769163,15031152133447369380,262144 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:105⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15575330601281127704,5616636550388806972,524288 --field-trial-handle=2524,i,13951723768459621776,13868363837181503213,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:145⤵
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
the-real-index
the-real-index~RFe59f3cc.TMP
SiteList-Enterprise.json
Edge Profile.ico
58ae47a2-4925-4796-86e8-ee9f75fdfe45.tmp
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5984d6.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe59d9bc.TMP
e441fae1-dead-4606-9d82-e4736b412793.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
content_new.js
memory/2992-19-0x0000000000400000-0x0000000000435000-memory.dmp
memory/3632-15-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-17-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-13-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3632-10-0x0000000000730000-0x0000000000732000-memory.dmp
memory/3632-8-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-6-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-0-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3632-12-0x0000000000730000-0x0000000000732000-memory.dmp
memory/3632-4-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-5-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-14-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-11-0x0000000002320000-0x0000000002321000-memory.dmp
memory/3632-7-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-71-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3632-16-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-9-0x0000000000409000-0x000000000040A000-memory.dmp
memory/3632-56-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-61-0x0000000000730000-0x0000000000732000-memory.dmp
memory/3632-54-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-3-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-1-0x0000000002460000-0x00000000034EE000-memory.dmp
memory/3632-18-0x0000000002460000-0x00000000034EE000-memory.dmp