Malware Analysis Report

2024-09-22 21:56

Sample ID 240602-lr35gaad22
Target SQLi v.8.5.exe
SHA256 b693010f3f342fb06dd959f2553b7937d5daeaf9b4b7fd800ed5a9a6d8a099e7
Tags
bitrat persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b693010f3f342fb06dd959f2553b7937d5daeaf9b4b7fd800ed5a9a6d8a099e7

Threat Level: Known bad

The file SQLi v.8.5.exe was found to be: Known bad.

Malicious Activity Summary

bitrat persistence trojan upx

BitRAT

Executes dropped EXE

Checks computer location settings

UPX packed file

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

NTFS ADS

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-02 09:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 09:46

Reported

2024-06-02 09:47

Platform

win7-20240508-en

Max time kernel

23s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe"

Signatures

BitRAT

trojan bitrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\shwifty = "C:\\users\\Admin\\AppData\\Local\\Temp\\shwifty.exe" C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3020 set thread context of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local:02-06-2024 C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
File opened for modification C:\Users\Admin\AppData\Local:02-06-2024 C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 108 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\0.exe
PID 108 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\0.exe
PID 108 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\0.exe
PID 108 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\0.exe
PID 108 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 108 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 108 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 108 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 3020 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 3020 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 3020 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 3020 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 3020 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe
PID 3020 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe

"C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe"

C:\Users\Admin\AppData\Local\Temp\0.exe

"C:\Users\Admin\AppData\Local\Temp\0.exe"

C:\Users\Admin\AppData\Local\Temp\pebloso.exe

"C:\Users\Admin\AppData\Local\Temp\pebloso.exe"

C:\Users\Admin\AppData\Local\Temp\pebloso.exe

"C:\Users\Admin\AppData\Local\Temp\pebloso.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:80 pastebin.com tcp
US 172.67.19.24:443 pastebin.com tcp
RU 80.85.156.209:8080 tcp

Files

memory/108-0-0x0000000000230000-0x0000000000231000-memory.dmp

\Users\Admin\AppData\Local\Temp\0.exe

MD5 f558500b09118c2d5482c0097d41b986
SHA1 ebdd90df103acb0a28a46b4affde511f5b0bb6d0
SHA256 4081a78ba280d28c56551983e515486a1dacf9ba26a3e76a71060982cc9e5ed7
SHA512 d4bfd969d7e8e0ff7aedf55ea69398ced8bd81dd2bde7e87a79d6890fa4b38d0275ceb8c72e20336d97bff2252cd904e27f8023b93dacf961d7345d18e0e7441

\Users\Admin\AppData\Local\Temp\pebloso.exe

MD5 4d28de913b4b1e07f75c75e3cdd75add
SHA1 ce6735e3a3b68b904bda4ea150adfed689b8d18a
SHA256 e43d70c273c8c083b5368e6c8dfd74e403a3f6b5e263609497940bb94ecc6f01
SHA512 ea7bc0621977f6a9833c28945c41681c065073fb8b63e44118d772f0132dea60c6ed2c5129cb6072d5e315ee82e512bc54686adace9aa979e443b7803aa41a1a

memory/2272-12-0x00000000003F0000-0x000000000064A000-memory.dmp

memory/108-14-0x0000000000400000-0x00000000010C1000-memory.dmp

memory/2584-18-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2584-24-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-25-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-23-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-21-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/3020-26-0x0000000000400000-0x0000000000A8E000-memory.dmp

memory/2584-28-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-34-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-35-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-37-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-38-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-40-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-41-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-43-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-46-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-44-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-47-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-49-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-50-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-52-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-53-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-54-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-56-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-60-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-58-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-64-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-66-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-63-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-61-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-67-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-70-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-68-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-75-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-77-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-79-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-83-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-85-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-90-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-88-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-96-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-102-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-94-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-93-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-91-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-87-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-81-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-80-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-73-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-72-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-97-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-99-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-100-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2584-145-0x0000000000400000-0x00000000007E4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 09:46

Reported

2024-06-02 09:49

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe"

Signatures

BitRAT

trojan bitrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\shwifty = "C:\\users\\Admin\\AppData\\Local\\Temp\\shwifty.exe" C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4708 set thread context of 1600 N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe C:\Users\Admin\AppData\Local\Temp\pebloso.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\pebloso.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe

"C:\Users\Admin\AppData\Local\Temp\SQLi v.8.5.exe"

C:\Users\Admin\AppData\Local\Temp\0.exe

"C:\Users\Admin\AppData\Local\Temp\0.exe"

C:\Users\Admin\AppData\Local\Temp\pebloso.exe

"C:\Users\Admin\AppData\Local\Temp\pebloso.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4b4 0x33c

C:\Users\Admin\AppData\Local\Temp\pebloso.exe

"C:\Users\Admin\AppData\Local\Temp\pebloso.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:80 pastebin.com tcp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
RU 80.85.156.209:8080 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
RU 80.85.156.209:8080 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 80.85.156.209:8080 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
RU 80.85.156.209:8080 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 80.85.156.209:8080 tcp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

memory/2132-0-0x0000000001390000-0x0000000001391000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0.exe

MD5 f558500b09118c2d5482c0097d41b986
SHA1 ebdd90df103acb0a28a46b4affde511f5b0bb6d0
SHA256 4081a78ba280d28c56551983e515486a1dacf9ba26a3e76a71060982cc9e5ed7
SHA512 d4bfd969d7e8e0ff7aedf55ea69398ced8bd81dd2bde7e87a79d6890fa4b38d0275ceb8c72e20336d97bff2252cd904e27f8023b93dacf961d7345d18e0e7441

memory/3068-15-0x00007FFFEF7E3000-0x00007FFFEF7E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pebloso.exe

MD5 4d28de913b4b1e07f75c75e3cdd75add
SHA1 ce6735e3a3b68b904bda4ea150adfed689b8d18a
SHA256 e43d70c273c8c083b5368e6c8dfd74e403a3f6b5e263609497940bb94ecc6f01
SHA512 ea7bc0621977f6a9833c28945c41681c065073fb8b63e44118d772f0132dea60c6ed2c5129cb6072d5e315ee82e512bc54686adace9aa979e443b7803aa41a1a

memory/3068-21-0x0000000000500000-0x000000000075A000-memory.dmp

memory/3068-24-0x00007FFFEF7E0000-0x00007FFFF02A1000-memory.dmp

memory/2132-25-0x0000000000400000-0x00000000010C1000-memory.dmp

memory/1600-28-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-31-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-30-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-32-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/4708-33-0x0000000000400000-0x0000000000A8E000-memory.dmp

memory/1600-35-0x0000000074D50000-0x0000000074D89000-memory.dmp

memory/1600-36-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-41-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-42-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-43-0x0000000074A30000-0x0000000074A69000-memory.dmp

memory/1600-44-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/3068-45-0x00007FFFEF7E3000-0x00007FFFEF7E5000-memory.dmp

memory/3068-47-0x00007FFFEF7E0000-0x00007FFFF02A1000-memory.dmp

memory/1600-48-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-49-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-50-0x0000000074A30000-0x0000000074A69000-memory.dmp

memory/1600-51-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-54-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-55-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-57-0x0000000074A30000-0x0000000074A69000-memory.dmp

memory/1600-56-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-58-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-62-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-61-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-63-0x0000000074A30000-0x0000000074A69000-memory.dmp

memory/1600-64-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-68-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-69-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1600-70-0x0000000074A30000-0x0000000074A69000-memory.dmp

memory/1600-71-0x0000000000400000-0x00000000007E4000-memory.dmp