Analysis

  • max time kernel
    153s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    12/01/2022, 12:19

General

  • Target
    SecuriteInfo.com.W32.AIDetect.malware1.19951.14165.exe
  • Size 310KB
  • Sample220112-pg6z6acfak
  • SHA256 9373b23da09b4af4772e437447dd4151035c9f82eef60ca17e400cbf65aada89
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • patmushta.info

  • parubey.info

Extracted

Family
  • raccoon

Version
  • 1.8.4-hotfixs

rc4.plain

Extracted

Family
  • vidar

Version
  • 49.6

Botnet
  • 1125

C2
  • https://noc.social/@banda5ker

  • https://mastodon.social/@banda6ker

Attributes
  • profile_id

    1125

Extracted

Family
  • amadey

Version
  • 3.01

C2
  • 185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Vidar Stealer 4 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.19951.14165.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.19951.14165.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.19951.14165.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.19951.14165.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2856
  • C:\Users\Admin\AppData\Local\Temp\15D6.exe
    C:\Users\Admin\AppData\Local\Temp\15D6.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2404
  • C:\Users\Admin\AppData\Local\Temp\2C0E.exe
    C:\Users\Admin\AppData\Local\Temp\2C0E.exe
    1⤵
    • Executes dropped EXE
    PID:3164
  • C:\Users\Admin\AppData\Local\Temp\2FF7.exe
    C:\Users\Admin\AppData\Local\Temp\2FF7.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3580
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vaicvso\
      2⤵
        PID:604
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gnizejvc.exe" C:\Windows\SysWOW64\vaicvso\
        2⤵
          PID:716
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create vaicvso binPath= "C:\Windows\SysWOW64\vaicvso\gnizejvc.exe /d\"C:\Users\Admin\AppData\Local\Temp\2FF7.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1472
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description vaicvso "wifi internet conection"
            2⤵
              PID:3492
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start vaicvso
              2⤵
                PID:2392
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1780
              • C:\Users\Admin\AppData\Local\Temp\3305.exe
                C:\Users\Admin\AppData\Local\Temp\3305.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3284
                • C:\Users\Admin\AppData\Local\Temp\3305.exe
                  C:\Users\Admin\AppData\Local\Temp\3305.exe
                  2⤵
                  • Executes dropped EXE
                  PID:864
                • C:\Users\Admin\AppData\Local\Temp\3305.exe
                  C:\Users\Admin\AppData\Local\Temp\3305.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3124
              • C:\Windows\SysWOW64\vaicvso\gnizejvc.exe
                C:\Windows\SysWOW64\vaicvso\gnizejvc.exe /d"C:\Users\Admin\AppData\Local\Temp\2FF7.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1720
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:4036
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:920
              • C:\Users\Admin\AppData\Local\Temp\8C33.exe
                C:\Users\Admin\AppData\Local\Temp\8C33.exe
                1⤵
                • Executes dropped EXE
                PID:3840
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 948
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:592
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:2804
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:3920
                • C:\Users\Admin\AppData\Local\Temp\9B95.exe
                  C:\Users\Admin\AppData\Local\Temp\9B95.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:3088
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1696
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3804
                • C:\Users\Admin\AppData\Local\Temp\A2CA.exe
                  C:\Users\Admin\AppData\Local\Temp\A2CA.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4080
                • C:\Users\Admin\AppData\Local\Temp\A56B.exe
                  C:\Users\Admin\AppData\Local\Temp\A56B.exe
                  1⤵
                  • Executes dropped EXE
                  PID:720
                  • C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
                    "C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1592
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\
                      3⤵
                        PID:4084
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\
                          4⤵
                            PID:584
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:1548
                    • C:\Users\Admin\AppData\Local\Temp\AF4F.exe
                      C:\Users\Admin\AppData\Local\Temp\AF4F.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2764
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 404
                        2⤵
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2456
                    • C:\Users\Admin\AppData\Local\Temp\B1C1.exe
                      C:\Users\Admin\AppData\Local\Temp\B1C1.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1720
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1316
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3680
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3348
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                        2⤵
                          PID:2564
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                          2⤵
                            PID:1696
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                            2⤵
                              PID:2656
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                              2⤵
                                PID:3808
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                2⤵
                                  PID:3552
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                  2⤵
                                    PID:3996
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                    2⤵
                                      PID:2156
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                      2⤵
                                        PID:2608
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                        2⤵
                                          PID:1048
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                          2⤵
                                            PID:1996
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                            2⤵
                                              PID:1288
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                              2⤵
                                                PID:3164
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                                2⤵
                                                  PID:3264
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                                  2⤵
                                                    PID:760
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                                    2⤵
                                                      PID:1584
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                                      2⤵
                                                        PID:2400
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                                        2⤵
                                                          PID:1480
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA=
                                                          2⤵
                                                            PID:3160
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2036
                                                            2⤵
                                                            • Program crash
                                                            PID:896
                                                        • C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
                                                          C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3504

                                                        Network

                                                              MITRE ATT&CK Enterprise v6

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              memory/720-243-0x0000000000400000-0x0000000000578000-memory.dmp

                                                              memory/720-241-0x00000000001C0000-0x00000000001F8000-memory.dmp

                                                              memory/920-226-0x0000000003000000-0x00000000030F1000-memory.dmp

                                                              memory/920-233-0x0000000003000000-0x00000000030F1000-memory.dmp

                                                              memory/1316-262-0x0000000004AC2000-0x0000000004AC3000-memory.dmp

                                                              memory/1316-267-0x0000000007120000-0x0000000007142000-memory.dmp

                                                              memory/1316-288-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                              memory/1316-275-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                              memory/1316-260-0x00000000071A0000-0x00000000077C8000-memory.dmp

                                                              memory/1316-261-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                              memory/1316-257-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                              memory/1316-258-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                              memory/1316-271-0x00000000079B0000-0x0000000007D00000-memory.dmp

                                                              memory/1316-270-0x0000000007060000-0x00000000070C6000-memory.dmp

                                                              memory/1316-269-0x0000000007940000-0x00000000079A6000-memory.dmp

                                                              memory/1316-259-0x00000000048F0000-0x0000000004926000-memory.dmp

                                                              memory/1592-254-0x0000000000400000-0x0000000000578000-memory.dmp

                                                              memory/1592-252-0x00000000007F1000-0x000000000080F000-memory.dmp

                                                              memory/1720-157-0x000000000086C000-0x000000000087D000-memory.dmp

                                                              memory/1720-251-0x0000000000140000-0x000000000014E000-memory.dmp

                                                              memory/1720-250-0x0000000000140000-0x000000000014E000-memory.dmp

                                                              memory/1720-163-0x0000000000400000-0x000000000056A000-memory.dmp

                                                              memory/2404-125-0x0000000000400000-0x0000000000452000-memory.dmp

                                                              memory/2404-123-0x0000000000460000-0x000000000050E000-memory.dmp

                                                              memory/2404-124-0x0000000000460000-0x000000000050E000-memory.dmp

                                                              memory/2564-345-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                                                              memory/2564-344-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                                                              memory/2564-359-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                                                              memory/2608-115-0x0000000000831000-0x0000000000841000-memory.dmp

                                                              memory/2608-118-0x0000000000030000-0x0000000000039000-memory.dmp

                                                              memory/2764-246-0x0000000002520000-0x0000000002580000-memory.dmp

                                                              memory/2804-188-0x0000000002A00000-0x0000000002A74000-memory.dmp

                                                              memory/2804-189-0x0000000002740000-0x00000000027AB000-memory.dmp

                                                              memory/2856-116-0x0000000000400000-0x0000000000409000-memory.dmp

                                                              memory/2892-119-0x0000000000F40000-0x0000000000F56000-memory.dmp

                                                              memory/2892-135-0x0000000003070000-0x0000000003086000-memory.dmp

                                                              memory/3088-224-0x0000000075440000-0x0000000075531000-memory.dmp

                                                              memory/3088-202-0x0000000000400000-0x0000000000610000-memory.dmp

                                                              memory/3088-265-0x00000000706C0000-0x00000000706E4000-memory.dmp

                                                              memory/3088-200-0x0000000000400000-0x0000000000610000-memory.dmp

                                                              memory/3088-266-0x000000006E370000-0x000000006E4A4000-memory.dmp

                                                              memory/3088-199-0x0000000000760000-0x00000000007A6000-memory.dmp

                                                              memory/3088-201-0x0000000000400000-0x0000000000610000-memory.dmp

                                                              memory/3088-206-0x0000000074930000-0x0000000074AF2000-memory.dmp

                                                              memory/3088-205-0x0000000000400000-0x0000000000610000-memory.dmp

                                                              memory/3088-204-0x0000000000400000-0x0000000000610000-memory.dmp

                                                              memory/3088-203-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                                              memory/3124-179-0x00000000059B0000-0x00000000059CE000-memory.dmp

                                                              memory/3124-178-0x0000000005A50000-0x0000000005AE2000-memory.dmp

                                                              memory/3124-164-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              memory/3124-172-0x0000000005670000-0x000000000577A000-memory.dmp

                                                              memory/3124-170-0x0000000005B30000-0x0000000006136000-memory.dmp

                                                              memory/3124-182-0x00000000076B0000-0x0000000007BDC000-memory.dmp

                                                              memory/3124-181-0x0000000006FB0000-0x0000000007172000-memory.dmp

                                                              memory/3124-180-0x00000000064C0000-0x0000000006526000-memory.dmp

                                                              memory/3124-168-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              memory/3124-177-0x0000000005930000-0x00000000059A6000-memory.dmp

                                                              memory/3124-171-0x0000000005540000-0x0000000005552000-memory.dmp

                                                              memory/3124-176-0x0000000006640000-0x0000000006B3E000-memory.dmp

                                                              memory/3124-175-0x0000000005520000-0x0000000005B26000-memory.dmp

                                                              memory/3124-174-0x00000000055E0000-0x000000000562B000-memory.dmp

                                                              memory/3124-173-0x00000000055A0000-0x00000000055DE000-memory.dmp

                                                              memory/3124-169-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              memory/3164-133-0x00000000001C0000-0x00000000001DC000-memory.dmp

                                                              memory/3164-134-0x0000000000400000-0x000000000056B000-memory.dmp

                                                              memory/3284-143-0x0000000005110000-0x0000000005186000-memory.dmp

                                                              memory/3284-146-0x00000000052E0000-0x00000000052E1000-memory.dmp

                                                              memory/3284-151-0x0000000005980000-0x0000000005E7E000-memory.dmp

                                                              memory/3284-148-0x00000000050C0000-0x00000000050DE000-memory.dmp

                                                              memory/3284-140-0x0000000000870000-0x00000000008FA000-memory.dmp

                                                              memory/3284-141-0x0000000000870000-0x00000000008FA000-memory.dmp

                                                              memory/3284-147-0x0000000002950000-0x0000000002951000-memory.dmp

                                                              memory/3348-317-0x0000000003130000-0x0000000003131000-memory.dmp

                                                              memory/3348-318-0x0000000003130000-0x0000000003131000-memory.dmp

                                                              memory/3348-334-0x0000000003130000-0x0000000003131000-memory.dmp

                                                              memory/3348-342-0x0000000003130000-0x0000000003131000-memory.dmp

                                                              memory/3580-145-0x0000000000400000-0x000000000056A000-memory.dmp

                                                              memory/3580-144-0x00000000001D0000-0x00000000001E3000-memory.dmp

                                                              memory/3580-138-0x00000000006B1000-0x00000000006C2000-memory.dmp

                                                              memory/3680-306-0x00000000035D0000-0x00000000035D1000-memory.dmp

                                                              memory/3680-292-0x00000000035D0000-0x00000000035D1000-memory.dmp

                                                              memory/3680-291-0x00000000035D0000-0x00000000035D1000-memory.dmp

                                                              memory/3680-315-0x00000000035D0000-0x00000000035D1000-memory.dmp

                                                              memory/3840-195-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                              memory/3840-192-0x0000000004880000-0x0000000004911000-memory.dmp

                                                              memory/3840-191-0x0000000002C70000-0x0000000002DBA000-memory.dmp

                                                              memory/3920-193-0x0000000000D30000-0x0000000000D37000-memory.dmp

                                                              memory/3920-194-0x0000000000D20000-0x0000000000D2C000-memory.dmp

                                                              memory/4036-161-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                                              memory/4036-158-0x0000000002EA0000-0x0000000002EB5000-memory.dmp

                                                              memory/4036-160-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                                              memory/4080-210-0x0000000000D20000-0x0000000000E46000-memory.dmp

                                                              memory/4080-227-0x0000000074DB0000-0x0000000075334000-memory.dmp

                                                              memory/4080-214-0x0000000000D20000-0x0000000000E46000-memory.dmp

                                                              memory/4080-213-0x0000000075440000-0x0000000075531000-memory.dmp

                                                              memory/4080-212-0x0000000074930000-0x0000000074AF2000-memory.dmp

                                                              memory/4080-211-0x0000000000D00000-0x0000000000D01000-memory.dmp

                                                              memory/4080-222-0x0000000005010000-0x0000000005022000-memory.dmp

                                                              memory/4080-225-0x0000000005070000-0x00000000050AE000-memory.dmp

                                                              memory/4080-215-0x0000000000D20000-0x0000000000E46000-memory.dmp

                                                              memory/4080-234-0x0000000005180000-0x0000000005181000-memory.dmp

                                                              memory/4080-229-0x0000000076990000-0x0000000077CD8000-memory.dmp

                                                              memory/4080-235-0x00000000050B0000-0x00000000050FB000-memory.dmp

                                                              memory/4080-236-0x0000000073EC0000-0x0000000073F0B000-memory.dmp

                                                              memory/4080-223-0x0000000005190000-0x000000000529A000-memory.dmp

                                                              memory/4080-216-0x00000000741C0000-0x0000000074240000-memory.dmp

                                                              memory/4080-218-0x0000000000CA0000-0x0000000000CE5000-memory.dmp

                                                              memory/4080-219-0x00000000057A0000-0x0000000005DA6000-memory.dmp