Resubmissions
09/04/2024, 07:01
240409-htps3scd2w1009/04/2024, 07:01
240409-htf6yacc9x1009/04/2024, 07:00
240409-hs6p7scc811009/04/2024, 07:00
240409-hss44scc7z1007/03/2024, 22:29
240307-2eh7jagg4110Analysis
- max time kernel
600s - max time network
602s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
09/04/2024, 07:00
General
- Target New Text Document mod.exe
- Size 8KB
- Sample240409-hs6p7scc81
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
redline
-
6077866846
-
https://pastebin.com/raw/KE5Mft0T
Extracted
-
metasploit
-
metasploit_stager
-
91.92.247.21:8405
Extracted
-
xworm
-
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 32 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 30 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 9 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XMHHPYeR.exe"C:\Users\Admin\AppData\Local\Temp\XMHHPYeR.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe"C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe"C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 10483⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2o0.0.exe"C:\Users\Admin\AppData\Local\Temp\u2o0.0.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 13764⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2o0.1.exe"C:\Users\Admin\AppData\Local\Temp\u2o0.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 14363⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1671.tmp.bat""4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7896.tmp"6⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3856 -ip 38561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3456 -ip 34561⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2004 -ip 20041⤵
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
Document.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
responsibilitylead.exe
responsiibilitylead.exe
XMHHPYeR.exe
__PSScriptPolicyTest_4uixa4nv.qpr.ps1
1111.exe
1234.exe
555.exe
Document.exe
ISetup2.exe
ISetup8.exe
MStore.exe
Props.exe
Tester.exe
crypted6077866846MVYQY.exe
disable-defender.exe
i1gcbW1E.exe
mQxBvlTA.exe
pclient.exe
svchost.exe
test2.exe
wininit.exe
xIPJVPDq.exe
ioloDMLog.txt
tmp1671.tmp.bat
tmpB.tmp
u2z4.0.exe
u2z4.1.exe
memory/848-119-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/848-130-0x00000234B7F30000-0x00000234B7F40000-memory.dmp
memory/848-129-0x00000234B7F30000-0x00000234B7F40000-memory.dmp
memory/848-128-0x000002349F970000-0x000002349F992000-memory.dmp
memory/848-133-0x00000234B7F30000-0x00000234B7F40000-memory.dmp
memory/848-139-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/1004-466-0x0000000002520000-0x0000000002521000-memory.dmp
memory/1920-256-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-167-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-238-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-233-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-111-0x00000233F2F40000-0x00000233F2F50000-memory.dmp
memory/1920-94-0x00000233F09E0000-0x00000233F09E6000-memory.dmp
memory/1920-229-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-226-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-105-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/1920-421-0x00000233F2F40000-0x00000233F2F50000-memory.dmp
memory/1920-223-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-260-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-258-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-219-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-142-0x00000233F30A0000-0x00000233F3316000-memory.dmp
memory/1920-143-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-144-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-146-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-148-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-150-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-154-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-209-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-159-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-381-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/1920-243-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-170-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-252-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-175-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-188-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-190-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-248-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-192-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-197-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-199-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-201-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-203-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/1920-205-0x00000233F30A0000-0x00000233F3311000-memory.dmp
memory/2236-463-0x000000001B0D0000-0x000000001B0E0000-memory.dmp
memory/2236-455-0x00000000002A0000-0x00000000002EA000-memory.dmp
memory/2236-460-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/2972-488-0x00000000001F0000-0x0000000000206000-memory.dmp
memory/2972-491-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/3068-376-0x0000000002F90000-0x0000000002FB7000-memory.dmp
memory/3068-374-0x0000000002FC0000-0x00000000030C0000-memory.dmp
memory/3068-396-0x0000000000400000-0x0000000002D21000-memory.dmp
memory/3148-115-0x0000000140000000-0x0000000140004278-memory.dmp
memory/3396-166-0x0000000007370000-0x00000000073E6000-memory.dmp
memory/3396-264-0x0000000007650000-0x00000000076A0000-memory.dmp
memory/3396-173-0x0000000007330000-0x000000000734E000-memory.dmp
memory/3396-43-0x0000000001150000-0x0000000001172000-memory.dmp
memory/3396-251-0x0000000074620000-0x0000000074DD1000-memory.dmp
memory/3396-55-0x0000000074620000-0x0000000074DD1000-memory.dmp
memory/3396-56-0x0000000005730000-0x0000000005796000-memory.dmp
memory/3396-60-0x0000000006210000-0x0000000006828000-memory.dmp
memory/3396-141-0x0000000007780000-0x0000000007CAC000-memory.dmp
memory/3396-116-0x0000000006D30000-0x0000000006D6C000-memory.dmp
memory/3396-62-0x0000000005C90000-0x0000000005CA2000-memory.dmp
memory/3396-64-0x0000000005DC0000-0x0000000005ECA000-memory.dmp
memory/3396-317-0x0000000074620000-0x0000000074DD1000-memory.dmp
memory/3396-134-0x0000000007080000-0x0000000007242000-memory.dmp
memory/3396-75-0x00000000057E0000-0x00000000057F0000-memory.dmp
memory/3396-117-0x00000000061C0000-0x000000000620C000-memory.dmp
memory/3456-422-0x0000000002F80000-0x0000000003080000-memory.dmp
memory/3456-448-0x0000000000400000-0x0000000002D44000-memory.dmp
memory/3724-138-0x0000000006BA0000-0x0000000006BB0000-memory.dmp
memory/3724-61-0x0000000000F80000-0x000000000209C000-memory.dmp
memory/3724-97-0x00000000069E0000-0x00000000069F4000-memory.dmp
memory/3724-14-0x0000000000F80000-0x000000000209C000-memory.dmp
memory/3724-77-0x0000000000400000-0x000000000054E000-memory.dmp
memory/3724-74-0x0000000006B90000-0x0000000006B9A000-memory.dmp
memory/3724-131-0x0000000000F80000-0x000000000209C000-memory.dmp
memory/3724-132-0x0000000076470000-0x0000000076560000-memory.dmp
memory/3724-65-0x0000000006A00000-0x0000000006A92000-memory.dmp
memory/3724-24-0x0000000077284000-0x0000000077285000-memory.dmp
memory/3724-28-0x0000000076470000-0x0000000076560000-memory.dmp
memory/3724-63-0x0000000006FB0000-0x0000000007556000-memory.dmp
memory/3724-140-0x0000000076470000-0x0000000076560000-memory.dmp
memory/3724-29-0x0000000076470000-0x0000000076560000-memory.dmp
memory/3724-59-0x0000000000F80000-0x000000000209C000-memory.dmp
memory/3724-34-0x0000000077286000-0x0000000077288000-memory.dmp
memory/3856-255-0x0000000004A60000-0x0000000004ACC000-memory.dmp
memory/3856-253-0x0000000002DE0000-0x0000000002EE0000-memory.dmp
memory/3856-263-0x0000000000400000-0x0000000002D44000-memory.dmp
memory/4456-187-0x0000000003DE0000-0x0000000003DE4000-memory.dmp
memory/5024-0-0x0000000000020000-0x0000000000028000-memory.dmp
memory/5024-109-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp
memory/5024-118-0x000000001AC30000-0x000000001AC40000-memory.dmp
memory/5024-2-0x000000001AC30000-0x000000001AC40000-memory.dmp
memory/5024-1-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmp