Analysis
- max time kernel
79s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 17:00
General
- Target document-1649460969.xlsb
- Size 291KB
- Sample201113-fle1h8r7w2
- SHA256 04b8baff881e221f8efcdfe0f5fd63b9744be92158a42ef3188c310537b6a5bb
Malware Config
Extracted
-
smokeloader
-
2020
-
http://we11wdsgd.com/
Extracted
-
qakbot
-
tr01
-
1604997522
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
Signatures
- Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 518 IoCs
- Suspicious behavior: MapViewOfSection 31 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 73 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1649460969.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\F860.exeC:\Users\Admin\AppData\Local\Temp\F860.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F860.exeC:\Users\Admin\AppData\Local\Temp\F860.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Pbeoiyla\ltbuwdi.exeC:\Users\Admin\AppData\Roaming\Microsoft\Pbeoiyla\ltbuwdi.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Pbeoiyla\ltbuwdi.exeC:\Users\Admin\AppData\Roaming\Microsoft\Pbeoiyla\ltbuwdi.exe /C3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aqjsxycs /tr "\"C:\Users\Admin\AppData\Local\Temp\F860.exe\" /I aqjsxycs" /SC ONCE /Z /ST 17:29 /ET 17:412⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/212-464-0x00000000005D0000-0x00000000005DC000-memory.dmp
memory/212-470-0x00000000005E0000-0x00000000005E6000-memory.dmp
memory/1260-300-0x00000000008E0000-0x00000000008E7000-memory.dmp
memory/1260-297-0x00000000008D0000-0x00000000008DB000-memory.dmp
memory/1668-124-0x0000000000C30000-0x0000000000C39000-memory.dmp
memory/1840-19-0x0000000000D80000-0x0000000000DF5000-memory.dmp
memory/1840-17-0x0000000000D10000-0x0000000000D7B000-memory.dmp
memory/2196-899-0x00000000005F0000-0x00000000005FD000-memory.dmp
memory/2196-907-0x0000000000800000-0x0000000000807000-memory.dmp
memory/2424-591-0x0000000000C20000-0x0000000000C29000-memory.dmp
memory/2424-599-0x0000000000C30000-0x0000000000C35000-memory.dmp
memory/2444-347-0x0000000000F70000-0x0000000000F7E000-memory.dmp
memory/2444-351-0x0000000000F80000-0x0000000000F89000-memory.dmp
memory/2552-590-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-686-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-38-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-39-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-37-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-41-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-42-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-40-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-43-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-45-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-44-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-46-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1655-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1653-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1647-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-47-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-50-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-49-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-54-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1651-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1649-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-56-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-57-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-58-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-59-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-55-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-60-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-51-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-61-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-63-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-62-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-65-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-64-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-67-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-68-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-66-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-69-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-71-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-72-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-70-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-73-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-74-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-76-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-75-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-77-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-78-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-79-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-80-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-81-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-82-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-83-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-84-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-85-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-86-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-87-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-679-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-89-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-90-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-91-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-93-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-94-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-95-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-96-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-97-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-98-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-99-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-100-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-102-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-101-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-103-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-104-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-105-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-106-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-107-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-108-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-110-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-109-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-111-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-113-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-114-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-115-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-112-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-116-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-117-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-118-0x0000000001560000-0x0000000001564000-memory.dmp
memory/2552-121-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-34-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-122-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-35-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-126-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-127-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-128-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-123-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-119-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-129-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-130-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-131-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-132-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-133-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-135-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-134-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-136-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-137-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-139-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-138-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-140-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-141-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-142-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-143-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-144-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-145-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-146-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-147-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-148-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-149-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-150-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-151-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-152-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-153-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-154-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-155-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-156-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-157-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-158-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-159-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-160-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-161-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-162-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-163-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-164-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-165-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-166-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-167-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-168-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-169-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-245-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1645-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1643-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-33-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1641-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-32-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-30-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-31-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-28-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-29-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-27-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1639-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1637-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1628-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-26-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-25-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-24-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1634-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1631-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1625-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1622-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-23-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-583-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1611-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-15-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-18-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-598-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-575-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-605-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-613-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-628-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-633-0x0000000001560000-0x000000000157E000-memory.dmp
memory/2552-637-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1619-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1615-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-642-0x0000000001560000-0x000000000157E000-memory.dmp
memory/2552-620-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-646-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-661-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-22-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-36-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-88-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-670-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-694-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-6-0x00000000014A0000-0x00000000014B5000-memory.dmp
memory/2552-654-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-712-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-703-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-720-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1608-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-728-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-736-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1601-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-758-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-751-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-772-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-778-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-785-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-765-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-794-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1605-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-743-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-803-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1597-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-812-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1593-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-838-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1589-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-847-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-856-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-829-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-865-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1585-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-21-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-900-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-20-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-890-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-16-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-882-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-14-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-873-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-819-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-908-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-915-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-930-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-939-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-923-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-947-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-955-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1581-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1577-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-12-0x0000000003390000-0x00000000033FB000-memory.dmp
memory/2552-972-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1569-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-978-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-964-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-987-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1573-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1003-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-996-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1010-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1024-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1017-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1039-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1047-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1031-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1055-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1072-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1064-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1087-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1095-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1080-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1110-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1102-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1124-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1117-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1131-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1145-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1138-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1160-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1168-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1176-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1152-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1184-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1192-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1200-0x00000000014D0000-0x00000000014DA000-memory.dmp
memory/2552-1536-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1222-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1228-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1241-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1234-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1255-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1248-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-11-0x0000000003390000-0x00000000033FB000-memory.dmp
memory/2552-1270-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1263-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1284-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1277-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1291-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1305-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1312-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1298-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1318-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1325-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1339-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1332-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1346-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1359-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1353-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1366-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1372-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1379-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1386-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1394-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1401-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1414-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1421-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1407-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1433-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1439-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1427-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1445-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1457-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1451-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1468-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1463-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1474-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1480-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1485-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1491-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1497-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1503-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1509-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1515-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1520-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1526-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1565-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1531-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1542-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1548-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1553-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1557-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2552-1561-0x00000000014D0000-0x00000000014DB000-memory.dmp
memory/2880-666-0x0000000000960000-0x0000000000987000-memory.dmp
memory/2880-675-0x0000000000990000-0x00000000009B2000-memory.dmp
memory/3136-4-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/3336-963-0x0000000000440000-0x000000000044B000-memory.dmp
memory/3336-971-0x0000000000450000-0x0000000000458000-memory.dmp
memory/3452-643-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3588-248-0x0000000000AE0000-0x0000000000AEB000-memory.dmp
memory/3704-1541-0x0000000002080000-0x00000000020BA000-memory.dmp
memory/3912-1525-0x0000000002690000-0x0000000002691000-memory.dmp
memory/4368-53-0x0000000000B80000-0x0000000000B87000-memory.dmp
memory/4368-52-0x0000000000B70000-0x0000000000B7C000-memory.dmp
memory/4500-406-0x00000000005B0000-0x00000000005B5000-memory.dmp
memory/4500-401-0x00000000005A0000-0x00000000005A9000-memory.dmp
memory/4632-747-0x0000000000380000-0x0000000000389000-memory.dmp
memory/4632-755-0x0000000000390000-0x0000000000395000-memory.dmp
memory/4760-0-0x00007FF942060000-0x00007FF942697000-memory.dmp
memory/5068-833-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/5068-824-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/5100-535-0x0000000000360000-0x0000000000369000-memory.dmp
memory/5100-542-0x0000000000370000-0x0000000000374000-memory.dmp