Analysis
- max time kernel
599s - max time network
603s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/11/2024, 08:59
General
- Target 980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
- Size 30KB
- Sample241104-kxt83s1jfl
- SHA256 980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1
Malware Config
Extracted
-
phorphiex
-
http://b0t.to/
-
http://gshrghirhgsgrao.to/
-
http://hehfaofiehgggao.to/
-
http://soghrrsoeuhugao.to/
-
http://eiiiaoihoaeruao.to/
-
http://roiriorisioroao.to/
-
http://ouhgousgoahutao.to/
-
http://oeoaoueuoeuoaao.to/
-
http://aiaizzzezeezeao.to/
-
http://ouauooaoaoeeuao.to/
-
http://oeeoeuueueuueao.to/
-
http://eobbeaubfeuueao.to/
-
http://aauaaaeieiieeao.to/
-
http://aaaeieiiiofffao.to/
-
http://infineinfinigao.to/
-
http://baoefubfbfigoao.to/
-
http://aaauuwiifoogeao.to/
-
http://plporsiszsgetao.to/
-
http://gshrghirhgsgrla.co/
-
http://hehfaofiehgggla.co/
-
1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh
-
qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql
-
Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i
-
D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M
-
0xa5228127395263575a4b4f532e4f132b14599d24
-
LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7
-
t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0
Extracted
-
phorphiex
-
http://185.215.113.84
-
http://185.215.113.66
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Modifies security service 2 TTPs 3 IoCs
- Phorphiex family
- Phorphiex payload 3 IoCs
- Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
- Windows security bypass 2 TTPs 24 IoCs
- Xmrig family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 31 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Stops running service(s) 4 TTPs
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 25 IoCs
- Windows security modification 2 TTPs 28 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 8 IoCs
- Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe"C:\Users\Admin\AppData\Local\Temp\980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\37949668\sysddnr.exeC:\Windows\37949668\sysddnr.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23441.exeC:\Users\Admin\AppData\Local\Temp\23441.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysblvrvcr.exeC:\Windows\sysblvrvcr.exe5⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\198133041.exeC:\Users\Admin\AppData\Local\Temp\198133041.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2090427174.exeC:\Users\Admin\AppData\Local\Temp\2090427174.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1915218797.exeC:\Users\Admin\AppData\Local\Temp\1915218797.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3892412225.exeC:\Users\Admin\AppData\Local\Temp\3892412225.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\2285710112.exeC:\Users\Admin\AppData\Local\Temp\2285710112.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\1892230035.exeC:\Users\Admin\AppData\Local\Temp\1892230035.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\sysppvrdnvs.exeC:\Windows\sysppvrdnvs.exe7⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc9⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc9⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv9⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc9⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait9⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\2876132126.exeC:\Users\Admin\AppData\Local\Temp\2876132126.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f9⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"9⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\783223494.exeC:\Users\Admin\AppData\Local\Temp\783223494.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\608015116.exeC:\Users\Admin\AppData\Local\Temp\608015116.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\153056533.exeC:\Users\Admin\AppData\Local\Temp\153056533.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\12514.exeC:\Users\Admin\AppData\Local\Temp\12514.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\21276.exeC:\Users\Admin\AppData\Local\Temp\21276.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\12174.exeC:\Users\Admin\AppData\Local\Temp\12174.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\sysblvrvcr.exeC:\Users\Admin\sysblvrvcr.exe5⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc stop UsoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS /wait7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\252852848.exeC:\Users\Admin\AppData\Local\Temp\252852848.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2899026932.exeC:\Users\Admin\AppData\Local\Temp\2899026932.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\3275818656.exeC:\Users\Admin\AppData\Local\Temp\3275818656.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\36959972.exeC:\Users\Admin\AppData\Local\Temp\36959972.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\24716.exeC:\Users\Admin\AppData\Local\Temp\24716.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\33749.exeC:\Users\Admin\AppData\Local\Temp\33749.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
powershell.exe.log
2[1]
4[1]
3[1]
5[1]
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
1892230035.exe
1915218797.exe
198133041.exe
2090427174.exe
2219415501.exe
2285710112.exe
23441.exe
3892412225.exe
__PSScriptPolicyTest_npcyakfu.q4y.ps1
WR64.sys
tbtcmds.dat
tbtnds.dat
tbtnds.dat
sysddnr.exe
memory/8-120-0x0000000000260000-0x0000000000266000-memory.dmp
memory/1776-194-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-299-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-312-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-310-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-308-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-303-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-301-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-297-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-264-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-250-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-247-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-245-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-243-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-241-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-239-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-188-0x000002A00F440000-0x000002A00F460000-memory.dmp
memory/1776-237-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-234-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-190-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-232-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-192-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-230-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-196-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-198-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-200-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-203-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-205-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-207-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-224-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-226-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/1776-228-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp
memory/3404-392-0x0000000006150000-0x00000000064A4000-memory.dmp
memory/3404-421-0x0000000007C70000-0x0000000007C84000-memory.dmp
memory/3404-416-0x0000000007C30000-0x0000000007C41000-memory.dmp
memory/3404-415-0x0000000007AC0000-0x0000000007B63000-memory.dmp
memory/3404-405-0x000000006F890000-0x000000006F8DC000-memory.dmp
memory/3404-397-0x0000000006900000-0x000000000694C000-memory.dmp
memory/3404-168-0x00007FF697A00000-0x00007FF697F97000-memory.dmp
memory/3468-74-0x0000000007D90000-0x0000000007DA4000-memory.dmp
memory/3468-30-0x0000000005960000-0x0000000005982000-memory.dmp
memory/3468-64-0x00000000081E0000-0x000000000885A000-memory.dmp
memory/3468-44-0x0000000006850000-0x000000000689C000-memory.dmp
memory/3468-65-0x0000000007B60000-0x0000000007B7A000-memory.dmp
memory/3468-43-0x0000000006810000-0x000000000682E000-memory.dmp
memory/3468-28-0x0000000005260000-0x0000000005296000-memory.dmp
memory/3468-42-0x0000000006400000-0x0000000006754000-memory.dmp
memory/3468-52-0x000000006FAA0000-0x000000006FAEC000-memory.dmp
memory/3468-62-0x0000000006E30000-0x0000000006E4E000-memory.dmp
memory/3468-29-0x0000000005A40000-0x0000000006068000-memory.dmp
memory/3468-63-0x0000000007A10000-0x0000000007AB3000-memory.dmp
memory/3468-75-0x0000000007E80000-0x0000000007E9A000-memory.dmp
memory/3468-66-0x0000000007BB0000-0x0000000007BBA000-memory.dmp
memory/3468-76-0x0000000007E60000-0x0000000007E68000-memory.dmp
memory/3468-67-0x0000000007DC0000-0x0000000007E56000-memory.dmp
memory/3468-68-0x0000000007D60000-0x0000000007D71000-memory.dmp
memory/3468-32-0x00000000061D0000-0x0000000006236000-memory.dmp
memory/3468-31-0x0000000006070000-0x00000000060D6000-memory.dmp
memory/3468-73-0x0000000007D80000-0x0000000007D8E000-memory.dmp
memory/3468-51-0x0000000006DF0000-0x0000000006E22000-memory.dmp
memory/4008-290-0x0000000007420000-0x0000000007434000-memory.dmp
memory/4008-289-0x00000000073F0000-0x0000000007401000-memory.dmp
memory/4008-288-0x0000000006EB0000-0x0000000006F53000-memory.dmp
memory/4008-278-0x000000006F9F0000-0x000000006FA3C000-memory.dmp
memory/4008-277-0x0000000006430000-0x000000000647C000-memory.dmp
memory/4008-266-0x00000000058D0000-0x0000000005C24000-memory.dmp
memory/4240-187-0x00007FF75ECB0000-0x00007FF75F247000-memory.dmp
memory/4800-189-0x00007FF706B60000-0x00007FF706B89000-memory.dmp
memory/4800-191-0x00007FF706B60000-0x00007FF706B89000-memory.dmp
memory/4808-153-0x000001EA1F7F0000-0x000001EA1F812000-memory.dmp