revengerat | 3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08/05/2022, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Size 217KB
Sample220508-jb73daebaj
SHA256 3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7
MD5 28410510706c74c2ca6494f036ebbd94
SHA1 4068e6a8618dc47a08962f91121c7bedf51e2407
SHA512 f429fcba47b03e96be57219ecf7ff1d435510600eae6772bfddc11354d357325aaa140b6db16c8c0bdbfa6a615ff72223ed332472b7c02c7a8754d342a2cf952
MD5 SHA1 SHA512

Score

10^/10

revengerat nyancatrevenge evasion persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

hpdndbnb.duckdns.org:2404

Mutex

90a49aa7c27647e

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe\""	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe = "0"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe = "0"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe"	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	2480	WerFault.exe	16

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1424	timeout.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3600	powershell.exe
3896	powershell.exe
3444	powershell.exe
4304	powershell.exe
3600	powershell.exe
3444	powershell.exe
3896	powershell.exe
4304	powershell.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1424	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	82
PID 2480 wrote to memory of 1424	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	82
PID 2480 wrote to memory of 1424	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	82
PID 2480 wrote to memory of 3600	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	91
PID 2480 wrote to memory of 3600	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	91
PID 2480 wrote to memory of 3600	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	91
PID 2480 wrote to memory of 3896	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	90
PID 2480 wrote to memory of 3896	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	90
PID 2480 wrote to memory of 3896	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	90
PID 2480 wrote to memory of 3444	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	88
PID 2480 wrote to memory of 3444	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	88
PID 2480 wrote to memory of 3444	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	88
PID 2480 wrote to memory of 4304	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	86
PID 2480 wrote to memory of 4304	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	86
PID 2480 wrote to memory of 4304	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	86
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92
PID 2480 wrote to memory of 3052	2480	3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe	92

C:\Users\Admin\AppData\Local\Temp\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
"C:\Users\Admin\AppData\Local\Temp\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\timeout.exe
  timeout 48
  2⤵
  - Delays execution with timeout.exe
  PID:1424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe
  "C:\Users\Admin\AppData\Local\Temp\3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7.exe"
  2⤵
  - Checks processor information in registry
  PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 2276
  2⤵
  - Program crash
  PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2480 -ip 2480
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5595c752a8f185e2f6d723fb38e0c2f8e6711bfda658ca54ece19266e8a14865
MD5 d273e3ca56549a8c9d5e3fd25edc1807
SHA1 4e69dbf4f5ccc903f741de2b3f31b2736133034a
SHA512 8aedbb3eda21938e23622bcdcd4fda061394c16cf0b239a96105c1f64e3498ae8150db4b6cf36bd9a7c3063a978fbc5b7995485357cac410516b46080088a916
SSDEEP 384:4sf+BO9i+ggCTDJdogc2Jk+o9ooTVK6seYLME/B03SoZmfYSgojEDkSQ0gdMtkKF:VfIgCPo5rjooTVNgrqSBW2ED/Cm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5595c752a8f185e2f6d723fb38e0c2f8e6711bfda658ca54ece19266e8a14865
MD5 d273e3ca56549a8c9d5e3fd25edc1807
SHA1 4e69dbf4f5ccc903f741de2b3f31b2736133034a
SHA512 8aedbb3eda21938e23622bcdcd4fda061394c16cf0b239a96105c1f64e3498ae8150db4b6cf36bd9a7c3063a978fbc5b7995485357cac410516b46080088a916
SSDEEP 384:4sf+BO9i+ggCTDJdogc2Jk+o9ooTVK6seYLME/B03SoZmfYSgojEDkSQ0gdMtkKF:VfIgCPo5rjooTVNgrqSBW2ED/Cm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 9ed96f3e724c259bf215eb62fb67278de671fba7a6a4f6dbba53fe553b0c8ab7
MD5 1a13b8c6a80a7e881f34a2cf6e97055d
SHA1 a199faf4a9386c4d2dada8f01714522a93456aac
SHA512 5ace7c35dfa88875c9e207c876b7f5c6af6c5180fb07673532ffa95cb720b11dd0f7149fb987b65549d9f1a29157cff3e166702e41aac5bc74c3b51eb0fd2c15
SSDEEP 384:26+BG9i+85mR1IBBiGJk+o9oaT/K6seYLME/h03SoZCfYSv0jEDked0gdItkKhD:TMw1sobjoaT/NgrKSl5KEDyCq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2480-133-0x0000000005CF0000-0x0000000006294000-memory.dmp

Download

memory/2480-131-0x0000000005360000-0x00000000053FC000-memory.dmp

Download

memory/2480-130-0x0000000000A90000-0x0000000000ACA000-memory.dmp

Download

memory/3052-145-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3444-146-0x0000000007640000-0x0000000007672000-memory.dmp

Download

memory/3444-150-0x000000006FA20000-0x000000006FA6C000-memory.dmp

Download

memory/3600-137-0x00000000027D0000-0x0000000002806000-memory.dmp

Download

memory/3600-143-0x00000000060C0000-0x00000000060DE000-memory.dmp

Download

memory/3600-141-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/3600-142-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/3600-140-0x00000000050F0000-0x0000000005112000-memory.dmp

Download

memory/3600-148-0x000000006FA20000-0x000000006FA6C000-memory.dmp

Download

memory/3600-139-0x0000000005210000-0x0000000005838000-memory.dmp

Download

memory/3600-153-0x00000000073D0000-0x00000000073EA000-memory.dmp

Download

memory/3896-149-0x000000006FA20000-0x000000006FA6C000-memory.dmp

Download

memory/3896-152-0x0000000007650000-0x0000000007CCA000-memory.dmp

Download

memory/3896-154-0x0000000007080000-0x000000000708A000-memory.dmp

Download

memory/3896-156-0x0000000007240000-0x000000000724E000-memory.dmp

Download

memory/4304-155-0x0000000007390000-0x0000000007426000-memory.dmp

Download

memory/4304-157-0x0000000007450000-0x000000000746A000-memory.dmp

Download

memory/4304-158-0x0000000007430000-0x0000000007438000-memory.dmp

Download

memory/4304-147-0x000000006FA20000-0x000000006FA6C000-memory.dmp

Download

memory/4304-151-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download