Analysis

  • max time kernel
    89s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    17/12/2021, 21:07

General

  • Target
    2cc70834624f85f5dd83b987ea57c234.exe
  • Size 154KB
  • Sample211217-zyay6afabl
  • SHA256 bd897b933617680b7ec6fb5ef77fd8f03a3ac2804fba3601231cb29dcca95f7e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • mubrikych.top

  • oxxyfix.xyz

Extracted

Family
  • redline

Botnet
  • 1

C2
  • 86.107.197.138:38133

Extracted

Family
  • vidar

Version
  • 49.1

Botnet
  • 1100

C2
  • https://noc.social/@sergeev46

  • https://c.im/@sergeev47

Attributes
  • profile_id

    1100

Extracted

Family
  • amadey

Version
  • 2.86

C2
  • 185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Bazar/Team9 Loader payload 2 IoCs
  • Nirsoft 6 IoCs
  • Vidar Stealer 2 IoCs
  • Warzone RAT Payload 1 IoCs
  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cc70834624f85f5dd83b987ea57c234.exe
    "C:\Users\Admin\AppData\Local\Temp\2cc70834624f85f5dd83b987ea57c234.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\2cc70834624f85f5dd83b987ea57c234.exe
      "C:\Users\Admin\AppData\Local\Temp\2cc70834624f85f5dd83b987ea57c234.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2328
  • C:\Users\Admin\AppData\Local\Temp\123C.exe
    C:\Users\Admin\AppData\Local\Temp\123C.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1000
  • C:\Users\Admin\AppData\Local\Temp\72BD.exe
    C:\Users\Admin\AppData\Local\Temp\72BD.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3260
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\752F.dll
    1⤵
    • Loads dropped DLL
    PID:1592
  • C:\Users\Admin\AppData\Local\Temp\7EA6.exe
    C:\Users\Admin\AppData\Local\Temp\7EA6.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7EA6.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:1480
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\752F.dll,DllRegisterServer {0C4161B1-07D7-459E-92A9-EEA40533D9DF}
    1⤵
    • Loads dropped DLL
    PID:928
  • C:\Users\Admin\AppData\Local\Temp\8425.exe
    C:\Users\Admin\AppData\Local\Temp\8425.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:604
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pakfuavg\
      2⤵
        PID:1572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vrzxkiho.exe" C:\Windows\SysWOW64\pakfuavg\
        2⤵
          PID:2240
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create pakfuavg binPath= "C:\Windows\SysWOW64\pakfuavg\vrzxkiho.exe /d\"C:\Users\Admin\AppData\Local\Temp\8425.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3776
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description pakfuavg "wifi internet conection"
            2⤵
              PID:2592
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start pakfuavg
              2⤵
                PID:3592
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1060
              • C:\Users\Admin\AppData\Local\Temp\8D8C.exe
                C:\Users\Admin\AppData\Local\Temp\8D8C.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2212
                • C:\Users\Admin\AppData\Local\Temp\8D8C.exe
                  C:\Users\Admin\AppData\Local\Temp\8D8C.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1308
              • C:\Windows\SysWOW64\pakfuavg\vrzxkiho.exe
                C:\Windows\SysWOW64\pakfuavg\vrzxkiho.exe /d"C:\Users\Admin\AppData\Local\Temp\8425.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3144
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:3960
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3244
              • C:\Users\Admin\AppData\Local\Temp\B51A.exe
                C:\Users\Admin\AppData\Local\Temp\B51A.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:3140
              • C:\Users\Admin\AppData\Local\Temp\D5F2.exe
                C:\Users\Admin\AppData\Local\Temp\D5F2.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:1584
              • C:\Users\Admin\AppData\Local\Temp\E881.exe
                C:\Users\Admin\AppData\Local\Temp\E881.exe
                1⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:3224
              • C:\Users\Admin\AppData\Local\Temp\EB12.exe
                C:\Users\Admin\AppData\Local\Temp\EB12.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2464
                • C:\Users\Admin\AppData\Local\Temp\build_FullCrypt.exe
                  "C:\Users\Admin\AppData\Local\Temp\build_FullCrypt.exe"
                  2⤵
                    PID:2404
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im build_FullCrypt.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\build_FullCrypt.exe" & del C:\ProgramData\*.dll & exit
                      3⤵
                        PID:4784
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im build_FullCrypt.exe /f
                          4⤵
                          • Kills process with taskkill
                          PID:4924
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 6
                          4⤵
                          • Delays execution with timeout.exe
                          PID:372
                    • C:\Users\Admin\AppData\Local\Temp\1234.exe
                      "C:\Users\Admin\AppData\Local\Temp\1234.exe"
                      2⤵
                        PID:652
                    • C:\Users\Admin\AppData\Local\Temp\ECE8.exe
                      C:\Users\Admin\AppData\Local\Temp\ECE8.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2180
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ECE8.exe" -Force
                        2⤵
                          PID:1528
                        • C:\Users\Admin\AppData\Local\Temp\e6ee3379-3b86-4d56-88e2-8fa276cfe21d\6b74bd12-ddbb-4d7f-949a-44c6a94ff002.exe
                          "C:\Users\Admin\AppData\Local\Temp\e6ee3379-3b86-4d56-88e2-8fa276cfe21d\6b74bd12-ddbb-4d7f-949a-44c6a94ff002.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ECE8.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                          2⤵
                            PID:3652
                            • C:\Users\Admin\AppData\Local\Temp\e6ee3379-3b86-4d56-88e2-8fa276cfe21d\6b74bd12-ddbb-4d7f-949a-44c6a94ff002.exe
                              "C:\Users\Admin\AppData\Local\Temp\e6ee3379-3b86-4d56-88e2-8fa276cfe21d\6b74bd12-ddbb-4d7f-949a-44c6a94ff002.exe" /SpecialRun 4101d8 3652
                              3⤵
                                PID:3800
                          • C:\Users\Admin\AppData\Local\Temp\F3BF.exe
                            C:\Users\Admin\AppData\Local\Temp\F3BF.exe
                            1⤵
                              PID:3264
                            • C:\Users\Admin\AppData\Local\Temp\F8C1.exe
                              C:\Users\Admin\AppData\Local\Temp\F8C1.exe
                              1⤵
                                PID:1636
                                • C:\Users\Admin\AppData\Local\Temp\a_2021-12-17_20-49.exe
                                  "C:\Users\Admin\AppData\Local\Temp\a_2021-12-17_20-49.exe"
                                  2⤵
                                    PID:1740
                                    • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                                      "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                                      3⤵
                                        PID:4336
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                                          4⤵
                                            PID:5008
                                            • C:\Windows\SysWOW64\reg.exe
                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                                              5⤵
                                                PID:2868
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                                              4⤵
                                              • Creates scheduled task(s)
                                              PID:5052
                                      • C:\Users\Admin\AppData\Local\Temp\312.exe
                                        C:\Users\Admin\AppData\Local\Temp\312.exe
                                        1⤵
                                          PID:3584
                                        • C:\Users\Admin\AppData\Local\Temp\18BE.exe
                                          C:\Users\Admin\AppData\Local\Temp\18BE.exe
                                          1⤵
                                            PID:2176
                                            • C:\ProgramData\images.exe
                                              "C:\ProgramData\images.exe"
                                              2⤵
                                                PID:4592
                                            • C:\Windows\SysWOW64\explorer.exe
                                              C:\Windows\SysWOW64\explorer.exe
                                              1⤵
                                                PID:1732
                                              • C:\Users\Admin\AppData\Local\Temp\1FB5.exe
                                                C:\Users\Admin\AppData\Local\Temp\1FB5.exe
                                                1⤵
                                                  PID:2868
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1FB5.exe" -Force
                                                    2⤵
                                                      PID:3432
                                                    • C:\Users\Admin\AppData\Local\Temp\044f126b-6dfd-4942-94f1-b3bd9be3eb07\77223ea6-458d-46d6-b779-95bc9384dad9.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\044f126b-6dfd-4942-94f1-b3bd9be3eb07\77223ea6-458d-46d6-b779-95bc9384dad9.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1FB5.exe" /WindowState ""1"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                      2⤵
                                                        PID:3652
                                                        • C:\Users\Admin\AppData\Local\Temp\044f126b-6dfd-4942-94f1-b3bd9be3eb07\77223ea6-458d-46d6-b779-95bc9384dad9.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\044f126b-6dfd-4942-94f1-b3bd9be3eb07\77223ea6-458d-46d6-b779-95bc9384dad9.exe" /SpecialRun 4101d8 3652
                                                          3⤵
                                                            PID:4216
                                                      • C:\Windows\explorer.exe
                                                        C:\Windows\explorer.exe
                                                        1⤵
                                                          PID:2668

                                                        Network

                                                              MITRE ATT&CK Enterprise v6

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              memory/604-174-0x00000000001E0000-0x00000000001F3000-memory.dmp

                                                              memory/604-175-0x0000000000400000-0x000000000081C000-memory.dmp

                                                              memory/604-173-0x0000000000030000-0x000000000003D000-memory.dmp

                                                              memory/652-331-0x00000000047C3000-0x00000000047C5000-memory.dmp

                                                              memory/652-327-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                              memory/928-155-0x000002363C9F0000-0x000002363CBBE000-memory.dmp

                                                              memory/1000-125-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                              memory/1000-124-0x00000000004D0000-0x000000000057E000-memory.dmp

                                                              memory/1308-177-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              memory/1308-228-0x00000000070A0000-0x00000000070A1000-memory.dmp

                                                              memory/1308-229-0x00000000077A0000-0x00000000077A1000-memory.dmp

                                                              memory/1308-219-0x0000000006230000-0x0000000006231000-memory.dmp

                                                              memory/1308-190-0x0000000005510000-0x0000000005B16000-memory.dmp

                                                              memory/1308-213-0x00000000059C0000-0x00000000059C1000-memory.dmp

                                                              memory/1528-365-0x0000000004422000-0x0000000004423000-memory.dmp

                                                              memory/1528-452-0x0000000004423000-0x0000000004424000-memory.dmp

                                                              memory/1528-363-0x0000000004420000-0x0000000004421000-memory.dmp

                                                              memory/1528-437-0x000000007ED10000-0x000000007ED11000-memory.dmp

                                                              memory/1584-244-0x0000000001020000-0x0000000001021000-memory.dmp

                                                              memory/1584-243-0x0000000077A90000-0x0000000077B81000-memory.dmp

                                                              memory/1584-255-0x0000000002A40000-0x0000000002A85000-memory.dmp

                                                              memory/1584-256-0x00000000055A0000-0x00000000055A1000-memory.dmp

                                                              memory/1584-240-0x0000000001020000-0x00000000010BA000-memory.dmp

                                                              memory/1584-241-0x0000000000E90000-0x0000000000E91000-memory.dmp

                                                              memory/1584-242-0x0000000074DA0000-0x0000000074F62000-memory.dmp

                                                              memory/1592-144-0x0000000002C50000-0x0000000002E1E000-memory.dmp

                                                              memory/1636-324-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                              memory/1636-326-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                              memory/1732-383-0x0000000002F20000-0x0000000002F8B000-memory.dmp

                                                              memory/1732-380-0x0000000003200000-0x0000000003274000-memory.dmp

                                                              memory/1740-444-0x0000000000920000-0x0000000000A6A000-memory.dmp

                                                              memory/1740-445-0x0000000000C90000-0x0000000000CC8000-memory.dmp

                                                              memory/1740-447-0x0000000000400000-0x000000000082C000-memory.dmp

                                                              memory/2176-916-0x0000000002920000-0x0000000003320000-memory.dmp

                                                              memory/2180-291-0x0000000005710000-0x0000000005C0E000-memory.dmp

                                                              memory/2212-162-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                                                              memory/2212-168-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

                                                              memory/2212-164-0x0000000005710000-0x0000000005711000-memory.dmp

                                                              memory/2212-166-0x0000000005950000-0x0000000005951000-memory.dmp

                                                              memory/2212-165-0x00000000056F0000-0x00000000056F1000-memory.dmp

                                                              memory/2212-167-0x0000000005670000-0x0000000005671000-memory.dmp

                                                              memory/2328-115-0x0000000000400000-0x0000000000409000-memory.dmp

                                                              memory/2404-412-0x00000000021B0000-0x0000000002289000-memory.dmp

                                                              memory/2404-413-0x0000000000400000-0x0000000000541000-memory.dmp

                                                              memory/2432-169-0x0000000000820000-0x000000000096A000-memory.dmp

                                                              memory/2432-170-0x0000000000820000-0x000000000096A000-memory.dmp

                                                              memory/2432-171-0x0000000000400000-0x000000000081F000-memory.dmp

                                                              memory/2464-280-0x00000000027E0000-0x00000000027E1000-memory.dmp

                                                              memory/2464-279-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                              memory/2668-395-0x00000000003F0000-0x00000000003FC000-memory.dmp

                                                              memory/2668-392-0x0000000000680000-0x0000000000687000-memory.dmp

                                                              memory/2868-390-0x00000000052C0000-0x000000000535C000-memory.dmp

                                                              memory/3024-119-0x00000000004A0000-0x00000000004B6000-memory.dmp

                                                              memory/3024-126-0x0000000000750000-0x0000000000766000-memory.dmp

                                                              memory/3140-215-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                              memory/3140-209-0x0000000074F70000-0x00000000754F4000-memory.dmp

                                                              memory/3140-200-0x0000000074DA0000-0x0000000074F62000-memory.dmp

                                                              memory/3140-212-0x0000000002300000-0x0000000002345000-memory.dmp

                                                              memory/3140-199-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                              memory/3140-201-0x0000000077A90000-0x0000000077B81000-memory.dmp

                                                              memory/3140-202-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                              memory/3140-198-0x00000000002D0000-0x0000000000378000-memory.dmp

                                                              memory/3140-217-0x0000000070950000-0x000000007099B000-memory.dmp

                                                              memory/3140-204-0x0000000072700000-0x0000000072780000-memory.dmp

                                                              memory/3140-210-0x0000000075B40000-0x0000000076E88000-memory.dmp

                                                              memory/3144-223-0x0000000000400000-0x000000000081C000-memory.dmp

                                                              memory/3224-305-0x00000000030C4000-0x00000000030C5000-memory.dmp

                                                              memory/3224-330-0x00000000030C5000-0x00000000030C7000-memory.dmp

                                                              memory/3224-269-0x00000000030C0000-0x00000000030C2000-memory.dmp

                                                              memory/3260-141-0x00000000012B0000-0x00000000012B1000-memory.dmp

                                                              memory/3260-143-0x0000000002AF0000-0x0000000002B35000-memory.dmp

                                                              memory/3260-150-0x0000000070950000-0x000000007099B000-memory.dmp

                                                              memory/3260-146-0x0000000074F70000-0x00000000754F4000-memory.dmp

                                                              memory/3260-137-0x0000000072700000-0x0000000072780000-memory.dmp

                                                              memory/3260-130-0x00000000012D0000-0x0000000001339000-memory.dmp

                                                              memory/3260-149-0x0000000005060000-0x0000000005061000-memory.dmp

                                                              memory/3260-140-0x0000000005730000-0x0000000005731000-memory.dmp

                                                              memory/3260-147-0x0000000075B40000-0x0000000076E88000-memory.dmp

                                                              memory/3260-133-0x0000000077A90000-0x0000000077B81000-memory.dmp

                                                              memory/3260-131-0x0000000000120000-0x0000000000121000-memory.dmp

                                                              memory/3260-148-0x0000000005110000-0x0000000005111000-memory.dmp

                                                              memory/3260-145-0x0000000002E00000-0x0000000002E01000-memory.dmp

                                                              memory/3260-132-0x0000000074DA0000-0x0000000074F62000-memory.dmp

                                                              memory/3260-142-0x0000000005230000-0x0000000005231000-memory.dmp

                                                              memory/3260-134-0x00000000012D0000-0x00000000012D1000-memory.dmp

                                                              memory/3264-328-0x0000000005270000-0x000000000576E000-memory.dmp

                                                              memory/3264-308-0x0000000005270000-0x000000000576E000-memory.dmp

                                                              memory/3432-440-0x00000000044C0000-0x00000000044C1000-memory.dmp

                                                              memory/3432-575-0x00000000044C3000-0x00000000044C4000-memory.dmp

                                                              memory/3432-442-0x00000000044C2000-0x00000000044C3000-memory.dmp

                                                              memory/3432-546-0x000000007F4B0000-0x000000007F4B1000-memory.dmp

                                                              memory/3584-362-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                              memory/3584-334-0x0000000002130000-0x0000000002175000-memory.dmp

                                                              memory/3772-117-0x0000000000030000-0x0000000000039000-memory.dmp

                                                              memory/3772-118-0x0000000000820000-0x000000000096A000-memory.dmp

                                                              memory/3960-222-0x0000000002720000-0x0000000002721000-memory.dmp

                                                              memory/3960-224-0x0000000002720000-0x0000000002721000-memory.dmp

                                                              memory/3960-220-0x0000000002A10000-0x0000000002A25000-memory.dmp

                                                              memory/4336-582-0x0000000000400000-0x000000000082C000-memory.dmp

                                                              memory/4336-578-0x0000000000830000-0x00000000008DE000-memory.dmp