Resubmissions
17/04/2024, 14:54
240417-r96wzada861017/04/2024, 14:54
240417-r95znsee4v1017/04/2024, 14:54
240417-r943dada821017/04/2024, 14:54
240417-r9353sda771017/04/2024, 14:54
240417-r93jjsee3x1017/04/2024, 14:52
240417-r89apsed7w17/04/2024, 14:52
240417-r88n6sed7s15/04/2024, 13:19
240415-qkln3afc751010/04/2024, 12:02
240410-n7v5xaeh491010/04/2024, 12:02
240410-n7vjdaaa8t10Analysis
- max time kernel
1811s - max time network
1819s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
10/04/2024, 12:02
General
- Target 75bff99becc32bcbe56efbe7a75f4d45.exe
- Size 7.0MB
- Sample240410-n7v5xaeh49
- SHA256 8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2
Malware Config
Extracted
-
bitrat
-
1.38
-
obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80
-
communication_password
d93b4f1ee6f5b875a4f7fcef966bd09a
-
tor_process
WinSock
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- Detect ZGRat V1 34 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service 33 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exeC:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab475F.tmp
TarAB52.tmp
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs.new
cached-microdescs.new
state
state
libcrypto-1_1.dll
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
zlib1.dll
WinSock.exe
memory/304-2489-0x00000000743C0000-0x0000000074448000-memory.dmp
memory/304-2506-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/304-2477-0x0000000074680000-0x000000007494F000-memory.dmp
memory/304-2486-0x0000000074450000-0x000000007455A000-memory.dmp
memory/304-2492-0x00000000742F0000-0x00000000743BE000-memory.dmp
memory/304-2483-0x0000000074560000-0x0000000074628000-memory.dmp
memory/304-2529-0x00000000742F0000-0x00000000743BE000-memory.dmp
memory/304-2528-0x00000000743C0000-0x0000000074448000-memory.dmp
memory/304-2519-0x0000000074450000-0x000000007455A000-memory.dmp
memory/304-2518-0x0000000074560000-0x0000000074628000-memory.dmp
memory/304-2517-0x0000000074630000-0x0000000074679000-memory.dmp
memory/304-2516-0x0000000074680000-0x000000007494F000-memory.dmp
memory/304-2480-0x0000000074630000-0x0000000074679000-memory.dmp
memory/304-2473-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/304-2495-0x0000000075090000-0x00000000750B4000-memory.dmp
memory/1600-2616-0x0000000074690000-0x0000000074718000-memory.dmp
memory/1600-2641-0x0000000074830000-0x00000000748F8000-memory.dmp
memory/1600-2615-0x0000000074720000-0x000000007482A000-memory.dmp
memory/1600-2617-0x00000000742E0000-0x00000000743AE000-memory.dmp
memory/1600-2610-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/1600-2619-0x00000000743B0000-0x000000007467F000-memory.dmp
memory/1600-2611-0x0000000074900000-0x0000000074949000-memory.dmp
memory/1600-2640-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/1600-2618-0x00000000742B0000-0x00000000742D4000-memory.dmp
memory/1600-2612-0x0000000074830000-0x00000000748F8000-memory.dmp
memory/1760-2494-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/1760-2472-0x0000000004820000-0x0000000004C24000-memory.dmp
memory/1760-2639-0x0000000005730000-0x0000000005B34000-memory.dmp
memory/1760-2474-0x0000000004820000-0x0000000004C24000-memory.dmp
memory/1760-2630-0x0000000005730000-0x0000000005B34000-memory.dmp
memory/1760-2451-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/1760-2499-0x0000000004820000-0x0000000004C24000-memory.dmp
memory/1760-2507-0x0000000004820000-0x0000000004C24000-memory.dmp
memory/1760-2564-0x0000000005730000-0x0000000005B34000-memory.dmp
memory/1760-2681-0x0000000005730000-0x0000000005B34000-memory.dmp
memory/2228-2592-0x00000000742F0000-0x00000000743BE000-memory.dmp
memory/2228-2573-0x0000000075090000-0x00000000750B4000-memory.dmp
memory/2228-2568-0x0000000074630000-0x0000000074679000-memory.dmp
memory/2228-2567-0x0000000074680000-0x000000007494F000-memory.dmp
memory/2228-2565-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/2228-2571-0x00000000743C0000-0x0000000074448000-memory.dmp
memory/2228-2572-0x00000000742F0000-0x00000000743BE000-memory.dmp
memory/2228-2569-0x0000000074560000-0x0000000074628000-memory.dmp
memory/2228-2587-0x0000000074680000-0x000000007494F000-memory.dmp
memory/2228-2593-0x0000000075090000-0x00000000750B4000-memory.dmp
memory/2228-2591-0x00000000743C0000-0x0000000074448000-memory.dmp
memory/2228-2590-0x0000000074450000-0x000000007455A000-memory.dmp
memory/2228-2589-0x0000000074560000-0x0000000074628000-memory.dmp
memory/2228-2588-0x0000000074630000-0x0000000074679000-memory.dmp
memory/2228-2586-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/2228-2570-0x0000000074450000-0x000000007455A000-memory.dmp
memory/2812-2683-0x0000000000E90000-0x0000000001294000-memory.dmp
memory/2812-2685-0x00000000743B0000-0x000000007467F000-memory.dmp
memory/2812-2686-0x0000000074900000-0x0000000074949000-memory.dmp
memory/2812-2687-0x0000000074830000-0x00000000748F8000-memory.dmp
memory/2812-2689-0x0000000074690000-0x0000000074718000-memory.dmp
memory/2812-2688-0x0000000074720000-0x000000007482A000-memory.dmp
memory/3028-41-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-23-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-39-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-2452-0x0000000074640000-0x0000000074D2E000-memory.dmp
memory/3028-43-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-45-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-47-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-49-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-51-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-53-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-0-0x0000000074640000-0x0000000074D2E000-memory.dmp
memory/3028-55-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-57-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-35-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-33-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-31-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-29-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-25-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-27-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-37-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-21-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-19-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-17-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-15-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-13-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-7-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-11-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-9-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-6-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-59-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-61-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-63-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-65-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-67-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-69-0x00000000003D0000-0x000000000044C000-memory.dmp
memory/3028-5-0x00000000003D0000-0x0000000000452000-memory.dmp
memory/3028-4-0x00000000095D0000-0x0000000009AF0000-memory.dmp
memory/3028-3-0x0000000074640000-0x0000000074D2E000-memory.dmp
memory/3028-2-0x0000000005660000-0x00000000056A0000-memory.dmp
memory/3028-1-0x0000000001150000-0x0000000001858000-memory.dmp