Resubmissions
09/04/2024, 07:01
240409-htps3scd2w1009/04/2024, 07:01
240409-htf6yacc9x1009/04/2024, 07:00
240409-hs6p7scc811009/04/2024, 07:00
240409-hss44scc7z1007/03/2024, 22:29
240307-2eh7jagg4110Analysis
- max time kernel
6s - max time network
78s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 07:00
General
- Target New Text Document mod.exe
- Size 8KB
- Sample240409-hs6p7scc81
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
redline
-
6077866846
-
https://pastebin.com/raw/KE5Mft0T
Extracted
-
metasploit
-
metasploit_stager
-
91.92.247.21:8405
Extracted
-
xworm
-
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
- Detect Xworm Payload 3 IoCs
- Detect ZGRat V1 33 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 4 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 10 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 6 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PoeIrffW.exe"C:\Users\Admin\AppData\Local\Temp\PoeIrffW.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
-
-
-
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
-
C:\Windows\Temp\Temp.exeC:\Windows\Temp\Temp.exe -s4⤵
-
-
-
C:\Windows\SysWOW64\MService.exe"C:\Windows\SysWOW64\MService.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u2wc.0.exe"C:\Users\Admin\AppData\Local\Temp\u2wc.0.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe"C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe6⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30007⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 22804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2wc.1.exe"C:\Users\Admin\AppData\Local\Temp\u2wc.1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD14⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 14123⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u3sg.0.exe"C:\Users\Admin\AppData\Local\Temp\u3sg.0.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 12564⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3sg.1.exe"C:\Users\Admin\AppData\Local\Temp\u3sg.1.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 14243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE493.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 8163⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 10203⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe3⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30004⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\new1.exe"C:\Users\Admin\AppData\Local\Temp\a\new1.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3756 -ip 37561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4912 -ip 49121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 640 -ip 6401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4336 -ip 43361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1656 -ip 16561⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
responsibilitylead.exe
PoeIrffW.exe
TmpAD28.tmp
__PSScriptPolicyTest_uj55ol1z.ywo.ps1
1111.exe
1234.exe
555.exe
Adobe_update.exe
BrawlB0t.exe
Document.exe
ISetup2.exe
ISetup8.exe
Ledger-Live.exe
MStore.exe
PrintSpoofer.exe
Props.exe
Retailer_prog.exe
Tester.exe
alexxxxxxxx.exe
crypted6077866846MVYQY.exe
disable-defender.exe
i1gcbW1E.exe
mQxBvlTA.exe
medcallaboratory5.exe
new1.exe
pclient.exe
securitycheck.exe
svchost.exe
swiiii.exe
test2.exe
wininit.exe
xIPJVPDq.exe
ioloDMLog.txt
ioloDMLog.txt
ioloDMLog.txt
u2wc.0.exe
u2wc.1.exe
Traffic.exe
propro.exe
memory/640-326-0x0000000004930000-0x0000000004957000-memory.dmp
memory/640-341-0x0000000000400000-0x0000000002D21000-memory.dmp
memory/640-324-0x0000000002E10000-0x0000000002F10000-memory.dmp
memory/1084-155-0x0000000001B80000-0x0000000001B84000-memory.dmp
memory/1652-2-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/1652-108-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp
memory/1652-1-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp
memory/1652-0-0x00000000005D0000-0x00000000005D8000-memory.dmp
memory/1652-122-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/1716-408-0x0000000000170000-0x0000000000186000-memory.dmp
memory/1716-427-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp
memory/1816-117-0x0000000140000000-0x0000000140004278-memory.dmp
memory/2668-31-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-64-0x0000000006930000-0x0000000006ED4000-memory.dmp
memory/2668-32-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-60-0x00000000005F0000-0x000000000170C000-memory.dmp
memory/2668-62-0x00000000005F0000-0x000000000170C000-memory.dmp
memory/2668-152-0x00000000005F0000-0x000000000170C000-memory.dmp
memory/2668-27-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-363-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-30-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-24-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-369-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-355-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-353-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-37-0x0000000077344000-0x0000000077346000-memory.dmp
memory/2668-23-0x0000000077342000-0x0000000077343000-memory.dmp
memory/2668-14-0x00000000005F0000-0x000000000170C000-memory.dmp
memory/2668-65-0x0000000006480000-0x0000000006512000-memory.dmp
memory/2668-66-0x0000000006550000-0x000000000655A000-memory.dmp
memory/2668-123-0x00000000065C0000-0x00000000065D0000-memory.dmp
memory/2668-69-0x0000000000400000-0x000000000054E000-memory.dmp
memory/2668-322-0x0000000076890000-0x0000000076980000-memory.dmp
memory/2668-77-0x0000000006540000-0x0000000006554000-memory.dmp
memory/3756-217-0x00000000049A0000-0x0000000004A0C000-memory.dmp
memory/3756-224-0x0000000000400000-0x0000000002D44000-memory.dmp
memory/3756-215-0x0000000003000000-0x0000000003100000-memory.dmp
memory/4592-201-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-151-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-233-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-235-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-238-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-240-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-242-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-244-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-247-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-227-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-225-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-222-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-220-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-218-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-214-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-212-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-207-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-196-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-186-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-194-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-104-0x0000028D40C70000-0x0000028D40C76000-memory.dmp
memory/4592-176-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-113-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp
memory/4592-115-0x0000028D5B260000-0x0000028D5B270000-memory.dmp
memory/4592-137-0x0000028D5B370000-0x0000028D5B5E6000-memory.dmp
memory/4592-173-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-229-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-150-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-156-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-158-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-169-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-160-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-162-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-164-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4592-424-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp
memory/4592-171-0x0000028D5B370000-0x0000028D5B5E1000-memory.dmp
memory/4656-397-0x00000000006E0000-0x000000000072A000-memory.dmp
memory/4656-420-0x000000001B500000-0x000000001B510000-memory.dmp
memory/4656-398-0x00007FFA5F780000-0x00007FFA60241000-memory.dmp
memory/4684-374-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/4792-175-0x0000000007240000-0x00000000072B6000-memory.dmp
memory/4792-453-0x0000000074790000-0x0000000074F40000-memory.dmp
memory/4792-154-0x00000000076F0000-0x0000000007C1C000-memory.dmp
memory/4792-403-0x0000000074790000-0x0000000074F40000-memory.dmp
memory/4792-46-0x00000000011D0000-0x00000000011F2000-memory.dmp
memory/4792-138-0x0000000006FF0000-0x00000000071B2000-memory.dmp
memory/4792-422-0x0000000005720000-0x0000000005730000-memory.dmp
memory/4792-120-0x0000000006CB0000-0x0000000006CFC000-memory.dmp
memory/4792-119-0x0000000006C70000-0x0000000006CAC000-memory.dmp
memory/4792-61-0x0000000074790000-0x0000000074F40000-memory.dmp
memory/4792-358-0x0000000007690000-0x00000000076E0000-memory.dmp
memory/4792-188-0x0000000006FC0000-0x0000000006FDE000-memory.dmp
memory/4792-82-0x0000000005720000-0x0000000005730000-memory.dmp
memory/4792-78-0x0000000005D30000-0x0000000005E3A000-memory.dmp
memory/4792-76-0x0000000005C00000-0x0000000005C12000-memory.dmp
memory/4792-73-0x0000000006190000-0x00000000067A8000-memory.dmp
memory/4792-63-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/4912-386-0x0000000002FE0000-0x00000000030E0000-memory.dmp
memory/4912-417-0x0000000000400000-0x0000000002D44000-memory.dmp