Resubmissions
17/04/2024, 14:54
240417-r96wzada861017/04/2024, 14:54
240417-r95znsee4v1017/04/2024, 14:54
240417-r943dada821017/04/2024, 14:54
240417-r9353sda771017/04/2024, 14:54
240417-r93jjsee3x1017/04/2024, 14:52
240417-r89apsed7w17/04/2024, 14:52
240417-r88n6sed7s15/04/2024, 13:19
240415-qkln3afc751010/04/2024, 12:02
240410-n7v5xaeh491010/04/2024, 12:02
240410-n7vjdaaa8t10Analysis
- max time kernel
1810s - max time network
1819s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
10/04/2024, 12:02
General
- Target 75bff99becc32bcbe56efbe7a75f4d45.exe
- Size 7.0MB
- Sample240410-n7v5xaeh49
- SHA256 8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2
Malware Config
Extracted
-
bitrat
-
1.38
-
obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80
-
communication_password
d93b4f1ee6f5b875a4f7fcef966bd09a
-
tor_process
WinSock
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- Detect ZGRat V1 34 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 37 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 40 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exeC:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exeC:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exeC:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exeC:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe"C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WinSock.exe
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs
cached-microdescs.new
cached-microdescs.new
state
state
libcrypto-1_1.dll
libssp-0.dll
libwinpthread-1.dll
torrc
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
zlib1.dll
memory/712-2468-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/712-2483-0x0000000073490000-0x000000007355E000-memory.dmp
memory/712-2481-0x0000000073560000-0x0000000073628000-memory.dmp
memory/712-2479-0x0000000001A80000-0x0000000001B08000-memory.dmp
memory/712-2478-0x0000000073270000-0x00000000732F8000-memory.dmp
memory/712-2500-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/712-2482-0x0000000073460000-0x0000000073484000-memory.dmp
memory/712-2480-0x0000000072FA0000-0x000000007326F000-memory.dmp
memory/712-2474-0x0000000073300000-0x000000007340A000-memory.dmp
memory/712-2472-0x0000000073410000-0x0000000073459000-memory.dmp
memory/712-2501-0x0000000073410000-0x0000000073459000-memory.dmp
memory/712-2510-0x0000000073300000-0x000000007340A000-memory.dmp
memory/712-2511-0x0000000001A80000-0x0000000001B08000-memory.dmp
memory/712-2611-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/1480-2627-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/1480-2613-0x0000000073460000-0x0000000073484000-memory.dmp
memory/1480-2603-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/1480-2605-0x0000000072FA0000-0x000000007326F000-memory.dmp
memory/1480-2607-0x0000000073560000-0x0000000073628000-memory.dmp
memory/1480-2610-0x0000000073410000-0x0000000073459000-memory.dmp
memory/1480-2618-0x0000000073270000-0x00000000732F8000-memory.dmp
memory/1480-2616-0x0000000073300000-0x000000007340A000-memory.dmp
memory/1480-2609-0x0000000073490000-0x000000007355E000-memory.dmp
memory/1480-2625-0x0000000073410000-0x0000000073459000-memory.dmp
memory/1480-2626-0x0000000073460000-0x0000000073484000-memory.dmp
memory/1480-2624-0x0000000073490000-0x000000007355E000-memory.dmp
memory/1480-2629-0x0000000073560000-0x0000000073628000-memory.dmp
memory/1480-2628-0x0000000072FA0000-0x000000007326F000-memory.dmp
memory/2936-2706-0x0000000073FA0000-0x0000000073FC4000-memory.dmp
memory/2936-2713-0x0000000073800000-0x0000000073ACF000-memory.dmp
memory/2936-2724-0x00000000733C0000-0x000000007348E000-memory.dmp
memory/2936-2701-0x0000000073730000-0x00000000737F8000-memory.dmp
memory/2936-2702-0x00000000733C0000-0x000000007348E000-memory.dmp
memory/2936-2704-0x0000000073FD0000-0x0000000074019000-memory.dmp
memory/2936-2723-0x0000000073730000-0x00000000737F8000-memory.dmp
memory/2936-2712-0x0000000073490000-0x0000000073518000-memory.dmp
memory/2936-2708-0x0000000073520000-0x000000007362A000-memory.dmp
memory/4540-2443-0x0000000073FE0000-0x000000007401A000-memory.dmp
memory/4540-2490-0x0000000072CD0000-0x0000000072D0A000-memory.dmp
memory/4540-2441-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/4540-2667-0x0000000073170000-0x00000000731AA000-memory.dmp
memory/4540-2556-0x00000000738E0000-0x000000007391A000-memory.dmp
memory/4540-2499-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/4564-2645-0x0000000073490000-0x0000000073518000-memory.dmp
memory/4564-2643-0x0000000073FD0000-0x0000000074019000-memory.dmp
memory/4564-2715-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/4564-2678-0x0000000073730000-0x00000000737F8000-memory.dmp
memory/4564-2669-0x0000000073800000-0x0000000073ACF000-memory.dmp
memory/4564-2668-0x00000000010D0000-0x00000000014D4000-memory.dmp
memory/4564-2648-0x0000000073FA0000-0x0000000073FC4000-memory.dmp
memory/4564-2651-0x00000000733C0000-0x000000007348E000-memory.dmp
memory/4564-2644-0x0000000073520000-0x000000007362A000-memory.dmp
memory/4564-2640-0x0000000073800000-0x0000000073ACF000-memory.dmp
memory/4564-2642-0x0000000073730000-0x00000000737F8000-memory.dmp
memory/4724-30-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-52-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-28-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-20-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-32-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-34-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-6-0x0000000073BF0000-0x00000000742DE000-memory.dmp
memory/4724-36-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-38-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-40-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-42-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-44-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-46-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-48-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-0-0x0000000073BF0000-0x00000000742DE000-memory.dmp
memory/4724-50-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-2440-0x0000000073BF0000-0x00000000742DE000-memory.dmp
memory/4724-7-0x0000000008010000-0x0000000008530000-memory.dmp
memory/4724-8-0x00000000050E0000-0x0000000005162000-memory.dmp
memory/4724-9-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-10-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-26-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-5-0x00000000056C0000-0x00000000056CA000-memory.dmp
memory/4724-12-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-4-0x0000000005820000-0x0000000005830000-memory.dmp
memory/4724-14-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-3-0x00000000056E0000-0x0000000005772000-memory.dmp
memory/4724-72-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-24-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-22-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-16-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-70-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-68-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-66-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-64-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-62-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-60-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-58-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-18-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-56-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-54-0x00000000050E0000-0x000000000515C000-memory.dmp
memory/4724-2-0x0000000005BE0000-0x00000000060DE000-memory.dmp
memory/4724-1-0x0000000000630000-0x0000000000D38000-memory.dmp