Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 15:58
General
- Target document-1367807809.xlsb
- Size 291KB
- Sample201113-8sypfflpcn
- SHA256 3cdb07cc6505abb9382b88b29af29359c538df1c5c4c34646d32349a90025ee3
Malware Config
Extracted
-
smokeloader
-
2020
-
http://we11wdsgd.com/
Extracted
-
qakbot
-
tr01
-
1604997522
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 554 IoCs
- Suspicious behavior: MapViewOfSection 32 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 77 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1367807809.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\28C6.exeC:\Users\Admin\AppData\Local\Temp\28C6.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\28C6.exeC:\Users\Admin\AppData\Local\Temp\28C6.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Aijogpyno\mofppx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Aijogpyno\mofppx.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Aijogpyno\mofppx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Aijogpyno\mofppx.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dlaxyotk /tr "\"C:\Users\Admin\AppData\Local\Temp\28C6.exe\" /I dlaxyotk" /SC ONCE /Z /ST 19:59 /ET 20:112⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/60-21-0x0000000000510000-0x000000000057B000-memory.dmp
memory/60-23-0x0000000000580000-0x00000000005F5000-memory.dmp
memory/512-444-0x0000000000340000-0x0000000000367000-memory.dmp
memory/512-447-0x0000000000370000-0x0000000000392000-memory.dmp
memory/640-0-0x00007FFA00640000-0x00007FFA00C77000-memory.dmp
memory/684-420-0x0000000001290000-0x0000000001295000-memory.dmp
memory/684-418-0x0000000001280000-0x0000000001289000-memory.dmp
memory/820-503-0x0000000002760000-0x0000000002761000-memory.dmp
memory/1144-43-0x0000000000800000-0x0000000000807000-memory.dmp
memory/1144-41-0x00000000005F0000-0x00000000005FC000-memory.dmp
memory/1200-354-0x0000000000890000-0x000000000089C000-memory.dmp
memory/1200-359-0x00000000008A0000-0x00000000008A6000-memory.dmp
memory/2148-305-0x0000000000850000-0x0000000000855000-memory.dmp
memory/2148-300-0x0000000000840000-0x0000000000849000-memory.dmp
memory/2268-255-0x0000000000AA0000-0x0000000000AA9000-memory.dmp
memory/2268-251-0x0000000000A90000-0x0000000000A9E000-memory.dmp
memory/2376-490-0x00000000005B0000-0x00000000005BB000-memory.dmp
memory/2376-493-0x00000000005C0000-0x00000000005C6000-memory.dmp
memory/2820-4-0x0000000000730000-0x0000000000731000-memory.dmp
memory/2984-904-0x0000000000720000-0x000000000075A000-memory.dmp
memory/3052-576-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-64-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-46-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-47-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-651-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-49-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-51-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-50-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-52-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-53-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-54-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-56-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-57-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-55-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-58-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-59-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-60-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-61-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-62-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-63-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-65-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-657-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-66-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-68-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-67-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-69-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-70-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-71-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-72-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-73-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-77-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-75-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1090-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1093-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-80-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1092-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1091-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-79-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-82-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-84-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-85-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-86-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-87-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-88-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-89-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-90-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-91-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-92-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-93-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-94-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-95-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-97-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-96-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-98-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-99-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-101-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-102-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-103-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-104-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-105-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-106-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-107-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-108-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-109-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-110-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-111-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-112-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-113-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-114-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-115-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-117-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-118-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-116-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-119-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-120-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-121-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-122-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-123-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-124-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-125-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-126-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-127-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-128-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-129-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-131-0x0000000002A30000-0x0000000002A39000-memory.dmp
memory/3052-130-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-132-0x0000000002A30000-0x0000000002A39000-memory.dmp
memory/3052-136-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1087-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-134-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-133-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-137-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-138-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1089-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-142-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1088-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-144-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-146-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-148-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-150-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-152-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-140-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-156-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-154-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-160-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-158-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-162-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-164-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-166-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-168-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-172-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-169-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-174-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-175-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-178-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-180-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-185-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-182-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-188-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1086-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-191-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1085-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-194-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-197-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1084-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-203-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-200-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-206-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-209-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-212-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-215-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-218-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-221-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-227-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-224-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-230-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-233-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-44-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-42-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-39-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-40-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-38-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-35-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-33-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-34-0x0000000002A30000-0x0000000002A3C000-memory.dmp
memory/3052-334-0x0000000000A90000-0x0000000000A99000-memory.dmp
memory/3052-31-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-32-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-30-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1082-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1083-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1081-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-407-0x0000000000A90000-0x0000000000A99000-memory.dmp
memory/3052-29-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-28-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-27-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-434-0x0000000000A90000-0x0000000000A99000-memory.dmp
memory/3052-26-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-19-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-22-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1079-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1080-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1078-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-25-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-24-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-20-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-18-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1077-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1076-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1074-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1075-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1071-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1073-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-544-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-547-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-552-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-550-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-558-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-555-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-561-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-564-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-570-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-567-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-573-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-17-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-15-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-588-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-585-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-16-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-580-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-14-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1072-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-594-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-591-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-597-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-600-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-603-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-606-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-609-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-612-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-618-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-615-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-621-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-627-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-624-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-633-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-636-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-630-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-639-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-642-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-645-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-648-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-48-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-45-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-734-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-660-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-663-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-669-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-666-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-672-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-675-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-681-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-678-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-683-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-685-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-689-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-687-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-691-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-696-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-693-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-699-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-702-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-708-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-705-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-711-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-710-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-714-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-716-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-718-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-725-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-728-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-722-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-731-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-737-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-654-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-743-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-746-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-740-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-749-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-755-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-752-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-761-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-758-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-768-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-765-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-1070-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-12-0x0000000002A30000-0x0000000002A9B000-memory.dmp
memory/3052-772-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-777-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-775-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-780-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-783-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-788-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-786-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-789-0x0000000000A70000-0x0000000000A79000-memory.dmp
memory/3052-795-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-799-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-797-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-801-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-803-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-807-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-805-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-809-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-811-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-813-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-817-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-815-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-819-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-821-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-823-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-825-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-827-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-829-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-831-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-833-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-835-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-839-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-837-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-841-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-845-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-847-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-843-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-849-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-851-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-853-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-855-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-859-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-857-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-863-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-861-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-865-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-867-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-869-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-871-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-873-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-875-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-877-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-879-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-881-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-883-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-885-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-887-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-889-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-891-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-893-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-895-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-897-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-899-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1068-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-902-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-900-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-903-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-11-0x0000000002A30000-0x0000000002A9B000-memory.dmp
memory/3052-907-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-905-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-908-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-909-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1069-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-910-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-911-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-912-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-913-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-915-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-916-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-917-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-914-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-918-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-920-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-919-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-921-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-922-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-923-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-6-0x0000000000A30000-0x0000000000A45000-memory.dmp
memory/3052-926-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-925-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-928-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-927-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-930-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-931-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-929-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-932-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-934-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-933-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-935-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-936-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-937-0x0000000000A70000-0x0000000000A7B000-memory.dmp
memory/3052-1025-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1026-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1027-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1028-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1029-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1030-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1031-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1032-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1033-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1034-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1035-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1036-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1037-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1039-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1038-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1040-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1041-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1042-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1043-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1044-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1045-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1047-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1046-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1049-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1048-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1050-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1051-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1053-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1052-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1055-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1056-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1057-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1054-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1058-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1060-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1059-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1062-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1061-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1063-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1065-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1066-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1067-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3052-1064-0x0000000000A70000-0x0000000000A7C000-memory.dmp
memory/3088-139-0x00000000032E0000-0x00000000032EB000-memory.dmp
memory/3088-141-0x00000000032F0000-0x00000000032FA000-memory.dmp
memory/3160-515-0x00000000008B0000-0x00000000008BD000-memory.dmp
memory/3160-518-0x00000000008C0000-0x00000000008C7000-memory.dmp
memory/3728-81-0x0000000002FE0000-0x0000000002FE9000-memory.dmp
memory/3728-83-0x0000000002FF0000-0x0000000002FF4000-memory.dmp
memory/3840-468-0x0000000003260000-0x0000000003269000-memory.dmp
memory/3840-471-0x0000000003270000-0x0000000003275000-memory.dmp
memory/3856-542-0x0000000000350000-0x0000000000358000-memory.dmp
memory/3856-539-0x0000000000340000-0x000000000034B000-memory.dmp
memory/3920-394-0x0000000000A50000-0x0000000000A54000-memory.dmp
memory/3920-391-0x0000000000A40000-0x0000000000A49000-memory.dmp
memory/3960-199-0x00000000004C0000-0x00000000004C7000-memory.dmp
memory/3960-196-0x00000000004B0000-0x00000000004BB000-memory.dmp
memory/4032-901-0x0000000002870000-0x0000000002871000-memory.dmp