Analysis
- max time kernel
284s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
08/05/2024, 22:22
General
- Target 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe
- Size 385KB
- Sample240508-2agg5sda77
- SHA256 0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5
Malware Config
Extracted
-
stealc
-
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Extracted
-
smokeloader
-
pub2
Signatures
- Detect ZGRat V1 3 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 27 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Windows security bypass 2 TTPs 10 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Drops startup file 7 IoCs
- Executes dropped EXE 19 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 10 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 16 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 10 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 10 IoCs
- Suspicious use of SendNotifyMessage 10 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"C:\Users\Admin\AppData\Local\Temp\0641dba2b3cad704f46c30e7af711f1623fe37759c8e3e5f9fc4fcefffdd8bf5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\D36fOT534DkOSsWbXB29gqLZ.exe"C:\Users\Admin\Pictures\D36fOT534DkOSsWbXB29gqLZ.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2qc.0.exe"C:\Users\Admin\AppData\Local\Temp\u2qc.0.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 11846⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2qc.1.exe"C:\Users\Admin\AppData\Local\Temp\u2qc.1.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\0pnferZgLsm9SiBkbYC0i2XN.exe"C:\Users\Admin\Pictures\0pnferZgLsm9SiBkbYC0i2XN.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\0pnferZgLsm9SiBkbYC0i2XN.exe"C:\Users\Admin\Pictures\0pnferZgLsm9SiBkbYC0i2XN.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\gAs0uPrTxcWAFQ9vLYSaatfX.exe"C:\Users\Admin\Pictures\gAs0uPrTxcWAFQ9vLYSaatfX.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\gAs0uPrTxcWAFQ9vLYSaatfX.exe"C:\Users\Admin\Pictures\gAs0uPrTxcWAFQ9vLYSaatfX.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\LQsWXcA1OlZjhvthLNEJGlBc.exe"C:\Users\Admin\Pictures\LQsWXcA1OlZjhvthLNEJGlBc.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\LQsWXcA1OlZjhvthLNEJGlBc.exe"C:\Users\Admin\Pictures\LQsWXcA1OlZjhvthLNEJGlBc.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\oBq51XPFQQiqa1o95cAqMjKC.exe"C:\Users\Admin\Pictures\oBq51XPFQQiqa1o95cAqMjKC.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Condos Condos.cmd & Condos.cmd & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"6⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 11716⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "MAKINGSICKDIFFERENTIALCONSOLES" Reached6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Preparation 1171\W6⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\Relation.pif1171\Relation.pif 1171\W6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.16⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Pictures\xCy3NmnoN9IHyUQ47BnTECsN.exe"C:\Users\Admin\Pictures\xCy3NmnoN9IHyUQ47BnTECsN.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\xCy3NmnoN9IHyUQ47BnTECsN.exe"C:\Users\Admin\Pictures\xCy3NmnoN9IHyUQ47BnTECsN.exe"5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\Relation.pifC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\Relation.pif2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\Relation.pifC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\Relation.pif2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
JVLpkLyj8MWk0w2BHsHIf0it.exe
powershell.exe.log
Relation.pif
Assumptions
Atmosphere
Bbw
Belly
Breakfast
Cds
Chapter
Chip
Condos
Cooper
Custom
Dawn
Desert
Headline
Ht
K
Lite
Ooo
Phenomenon
Pitch
Preparation
Radios
Rb
Reached
Relocation
Shades
Stress
Surfaces
Technique
Wonder
Za
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
__PSScriptPolicyTest_qgkr0kd4.ulr.ps1
ioloDMLog.txt
ioloDMLog.txt
u2qc.0.exe
u2qc.1.exe
0pnferZgLsm9SiBkbYC0i2XN.exe
D36fOT534DkOSsWbXB29gqLZ.exe
nwiTNkkw4BjQzoivN1m6vNPQ.exe
oBq51XPFQQiqa1o95cAqMjKC.exe
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
memory/508-4049-0x0000000000400000-0x000000000040B000-memory.dmp
memory/508-4699-0x0000000000400000-0x000000000040B000-memory.dmp
memory/656-1603-0x000000006D8C0000-0x000000006DC10000-memory.dmp
memory/656-1602-0x000000006E650000-0x000000006E69B000-memory.dmp
memory/1292-3730-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/1292-3733-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/1436-2-0x00007FFF8B980000-0x00007FFF8C36C000-memory.dmp
memory/1436-3325-0x00007FFF8B980000-0x00007FFF8C36C000-memory.dmp
memory/1436-2297-0x00007FFF8B983000-0x00007FFF8B984000-memory.dmp
memory/1436-0-0x000001A5AA4C0000-0x000001A5AA4CA000-memory.dmp
memory/1436-3-0x000001A5AC1C0000-0x000001A5AC1CA000-memory.dmp
memory/1436-1-0x00007FFF8B983000-0x00007FFF8B984000-memory.dmp
memory/1436-4-0x000001A5AC230000-0x000001A5AC28E000-memory.dmp
memory/1620-3226-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/1620-3227-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/1640-1262-0x0000000000400000-0x0000000002957000-memory.dmp
memory/2220-270-0x00000000095B0000-0x0000000009626000-memory.dmp
memory/2220-335-0x000000000A3D0000-0x000000000A3EE000-memory.dmp
memory/2220-153-0x00000000094F0000-0x000000000952C000-memory.dmp
memory/2220-113-0x00000000089A0000-0x00000000089EB000-memory.dmp
memory/2220-112-0x0000000008440000-0x000000000845C000-memory.dmp
memory/2220-329-0x000000000A3F0000-0x000000000A423000-memory.dmp
memory/2220-330-0x000000006E510000-0x000000006E55B000-memory.dmp
memory/2220-334-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/2220-341-0x000000000A430000-0x000000000A4D5000-memory.dmp
memory/2220-100-0x0000000007740000-0x0000000007D68000-memory.dmp
memory/2248-340-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/2248-333-0x000000006E510000-0x000000006E55B000-memory.dmp
memory/2248-352-0x000000000A8D0000-0x000000000A964000-memory.dmp
memory/2248-105-0x0000000007F60000-0x0000000007FC6000-memory.dmp
memory/2248-104-0x0000000007840000-0x0000000007862000-memory.dmp
memory/2248-109-0x0000000008080000-0x00000000083D0000-memory.dmp
memory/2248-106-0x0000000007FD0000-0x0000000008036000-memory.dmp
memory/2320-1432-0x000000006E650000-0x000000006E69B000-memory.dmp
memory/2320-1433-0x000000006D8C0000-0x000000006DC10000-memory.dmp
memory/2744-4198-0x00000000087C0000-0x000000000880B000-memory.dmp
memory/2744-4229-0x000000006ECE0000-0x000000006F030000-memory.dmp
memory/2744-4235-0x0000000009D40000-0x0000000009DE5000-memory.dmp
memory/2744-4228-0x000000006F180000-0x000000006F1CB000-memory.dmp
memory/2744-4196-0x00000000082D0000-0x0000000008620000-memory.dmp
memory/3056-1275-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3060-1288-0x0000000007E90000-0x0000000007EDB000-memory.dmp
memory/3060-1343-0x0000000008E40000-0x0000000008EE5000-memory.dmp
memory/3060-1336-0x000000006D8C0000-0x000000006DC10000-memory.dmp
memory/3060-1335-0x000000006E650000-0x000000006E69B000-memory.dmp
memory/3300-95-0x00000000047C0000-0x00000000047F6000-memory.dmp
memory/3300-331-0x000000006E510000-0x000000006E55B000-memory.dmp
memory/3300-1025-0x0000000009DB0000-0x0000000009DCA000-memory.dmp
memory/3300-1124-0x0000000009D90000-0x0000000009D98000-memory.dmp
memory/3300-332-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/3540-1254-0x0000000000400000-0x0000000002597000-memory.dmp
memory/3760-4956-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3760-4965-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3968-4984-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4951-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4947-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4940-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4978-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4981-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4960-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4963-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4957-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4954-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4972-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4969-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4966-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4987-0x0000000000400000-0x0000000002957000-memory.dmp
memory/3968-4975-0x0000000000400000-0x0000000002957000-memory.dmp
memory/4156-1285-0x0000000007F40000-0x0000000008290000-memory.dmp
memory/4156-1439-0x000000006D8C0000-0x000000006DC10000-memory.dmp
memory/4156-1434-0x000000006E650000-0x000000006E69B000-memory.dmp
memory/4424-3828-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/4424-3827-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/4520-4312-0x000001E36E5C0000-0x000001E36E5CC000-memory.dmp
memory/4520-4315-0x000001E36E680000-0x000001E36E6F6000-memory.dmp
memory/4520-4679-0x000001E36E5F0000-0x000001E36E60E000-memory.dmp
memory/4520-3302-0x000001E368D80000-0x000001E368E8A000-memory.dmp
memory/4520-4234-0x000001E36D390000-0x000001E36D398000-memory.dmp
memory/4520-4238-0x000001E36E520000-0x000001E36E52A000-memory.dmp
memory/4520-3233-0x000001E3496E0000-0x000001E34CF14000-memory.dmp
memory/4520-4243-0x000001E36EAF0000-0x000001E36F016000-memory.dmp
memory/4520-4239-0x000001E36E540000-0x000001E36E5A2000-memory.dmp
memory/4520-4240-0x000001E36E5A0000-0x000001E36E5C2000-memory.dmp
memory/4520-3305-0x000001E34EB00000-0x000001E34EB14000-memory.dmp
memory/4520-4200-0x000001E3690C0000-0x000001E369172000-memory.dmp
memory/4520-4236-0x000001E36E220000-0x000001E36E258000-memory.dmp
memory/4520-4203-0x000001E369210000-0x000001E369232000-memory.dmp
memory/4520-4201-0x000001E3691C0000-0x000001E369210000-memory.dmp
memory/4520-4202-0x000001E368C40000-0x000001E368C6A000-memory.dmp
memory/4520-3306-0x000001E368C00000-0x000001E368C24000-memory.dmp
memory/4520-4199-0x000001E34EA80000-0x000001E34EA8A000-memory.dmp
memory/4520-4206-0x000001E34EA90000-0x000001E34EA9A000-memory.dmp
memory/4520-4218-0x000001E369240000-0x000001E369540000-memory.dmp
memory/4520-3303-0x000001E34EAE0000-0x000001E34EAF0000-memory.dmp
memory/4520-3304-0x000001E34EB10000-0x000001E34EB1C000-memory.dmp
memory/4520-4237-0x000001E36D3F0000-0x000001E36D3F8000-memory.dmp
memory/4680-361-0x000000006E510000-0x000000006E55B000-memory.dmp
memory/4680-510-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/4716-4948-0x0000000000400000-0x0000000002574000-memory.dmp
memory/4716-4961-0x0000000000400000-0x0000000002574000-memory.dmp
memory/4716-1444-0x0000000000400000-0x0000000002574000-memory.dmp
memory/4716-4955-0x0000000000400000-0x0000000002574000-memory.dmp
memory/4716-4460-0x0000000000400000-0x0000000002574000-memory.dmp
memory/4888-1266-0x0000000000400000-0x0000000002957000-memory.dmp
memory/4948-2614-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/4948-2613-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/4988-1268-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5012-5-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5012-4461-0x000000007350E000-0x000000007350F000-memory.dmp
memory/5012-4700-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/5012-6-0x000000007350E000-0x000000007350F000-memory.dmp
memory/5012-7-0x0000000073500000-0x0000000073BEE000-memory.dmp
memory/5172-4719-0x000000006F1A0000-0x000000006F1EB000-memory.dmp
memory/5252-2308-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/5252-2309-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/5252-2258-0x00000000079D0000-0x0000000007A1B000-memory.dmp
memory/5252-2316-0x0000000008EA0000-0x0000000008F45000-memory.dmp
memory/5392-2337-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/5392-2338-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/5492-3223-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/5572-2323-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/5572-2328-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/5604-4462-0x0000000007BF0000-0x0000000007C3B000-memory.dmp
memory/5604-4481-0x000000006F1A0000-0x000000006F1EB000-memory.dmp
memory/5604-4482-0x000000006ECE0000-0x000000006F030000-memory.dmp
memory/5652-4184-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5652-3314-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5676-3487-0x000000006E150000-0x000000006E4A0000-memory.dmp
memory/5676-3486-0x000000006DBC0000-0x000000006DC0B000-memory.dmp
memory/5680-3311-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5680-3810-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5704-4197-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5704-3310-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5704-4185-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5748-3309-0x0000000000400000-0x0000000002957000-memory.dmp
memory/5748-4048-0x0000000000400000-0x0000000002957000-memory.dmp