Analysis

  • max time kernel
    2s
  • max time network
    827s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    21-11-2020 09:55

General

  • Target

    crash.vbs

  • Size

    105B

  • MD5

    9c1dab3943fbc8362978d3e920080905

  • SHA1

    45c21478ae728cbef837f49be04af7552f57396b

  • SHA256

    58b4cbfb0152e2cc2bc7c362842810875d6e789d9466c29b96a44db124b816da

  • SHA512

    c75c94432033d705ce6c601f05974994a6a9303b5f87f1ec38bb803621a92ef2485602058154e6a77b2eb0d4338eee36dd951b1c9e03cd644ad022854f1f2825

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
        3⤵
          PID:1964
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
          3⤵
            PID:1788
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
            3⤵
              PID:1892
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:848
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
              3⤵
                PID:1096
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
                3⤵
                  PID:2004
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
                2⤵
                  PID:1784
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
                  2⤵
                    PID:1204
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\crash.vbs"
                    2⤵
                      PID:1992

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/272-237-0x0000000000000000-mapping.dmp
                  • memory/344-18-0x0000000000000000-mapping.dmp
                  • memory/428-10-0x0000000000000000-mapping.dmp
                  • memory/600-15-0x0000000000000000-mapping.dmp
                  • memory/676-195-0x0000000000000000-mapping.dmp
                  • memory/724-16-0x0000000000000000-mapping.dmp
                  • memory/816-12-0x0000000000000000-mapping.dmp
                  • memory/848-1-0x0000000000000000-mapping.dmp
                  • memory/920-14-0x0000000000000000-mapping.dmp
                  • memory/952-28-0x0000000000000000-mapping.dmp
                  • memory/968-13-0x0000000000000000-mapping.dmp
                  • memory/992-17-0x0000000000000000-mapping.dmp
                  • memory/1064-361-0x0000000000000000-mapping.dmp
                  • memory/1096-5-0x0000000000000000-mapping.dmp
                  • memory/1120-32-0x0000000000000000-mapping.dmp
                  • memory/1172-29-0x0000000000000000-mapping.dmp
                  • memory/1204-6-0x0000000000000000-mapping.dmp
                  • memory/1296-173-0x0000000000000000-mapping.dmp
                  • memory/1332-31-0x0000000000000000-mapping.dmp
                  • memory/1404-217-0x0000000000000000-mapping.dmp
                  • memory/1436-382-0x0000000000000000-mapping.dmp
                  • memory/1440-259-0x0000000000000000-mapping.dmp
                  • memory/1472-30-0x0000000000000000-mapping.dmp
                  • memory/1536-19-0x0000000000000000-mapping.dmp
                  • memory/1576-23-0x0000000000000000-mapping.dmp
                  • memory/1612-24-0x0000000000000000-mapping.dmp
                  • memory/1640-0-0x0000000000000000-mapping.dmp
                  • memory/1644-467-0x0000000000000000-mapping.dmp
                  • memory/1652-25-0x0000000000000000-mapping.dmp
                  • memory/1664-27-0x0000000000000000-mapping.dmp
                  • memory/1680-255-0x0000000000000000-mapping.dmp
                  • memory/1736-22-0x0000000000000000-mapping.dmp
                  • memory/1744-11-0x0000000000000000-mapping.dmp
                  • memory/1748-245-0x0000000000000000-mapping.dmp
                  • memory/1760-531-0x0000000000000000-mapping.dmp
                  • memory/1784-3-0x0000000000000000-mapping.dmp
                  • memory/1788-4-0x0000000000000000-mapping.dmp
                  • memory/1844-343-0x0000000000000000-mapping.dmp
                  • memory/1888-21-0x0000000000000000-mapping.dmp
                  • memory/1892-7-0x0000000000000000-mapping.dmp
                  • memory/1916-20-0x0000000000000000-mapping.dmp
                  • memory/1964-2-0x0000000000000000-mapping.dmp
                  • memory/1992-120-0x0000000000120000-0x0000000000122000-memory.dmp
                    Filesize

                    8KB

                  • memory/1992-9-0x0000000000000000-mapping.dmp
                  • memory/1996-26-0x0000000000000000-mapping.dmp
                  • memory/2004-8-0x0000000000000000-mapping.dmp
                  • memory/2040-497-0x0000000000000000-mapping.dmp
                  • memory/2056-33-0x0000000000000000-mapping.dmp
                  • memory/2068-34-0x0000000000000000-mapping.dmp
                  • memory/2084-35-0x0000000000000000-mapping.dmp
                  • memory/2092-251-0x0000000000000000-mapping.dmp
                  • memory/2108-368-0x0000000000500000-0x0000000000502000-memory.dmp
                    Filesize

                    8KB

                  • memory/2108-36-0x0000000000000000-mapping.dmp
                  • memory/2160-37-0x0000000000000000-mapping.dmp
                  • memory/2172-392-0x0000000000000000-mapping.dmp
                  • memory/2220-38-0x0000000000000000-mapping.dmp
                  • memory/2236-39-0x0000000000000000-mapping.dmp
                  • memory/2264-40-0x0000000000000000-mapping.dmp
                  • memory/2276-149-0x0000000000000000-mapping.dmp
                  • memory/2292-41-0x0000000000000000-mapping.dmp
                  • memory/2304-42-0x0000000000000000-mapping.dmp
                  • memory/2316-43-0x0000000000000000-mapping.dmp
                  • memory/2336-44-0x0000000000000000-mapping.dmp
                  • memory/2348-45-0x0000000000000000-mapping.dmp
                  • memory/2360-464-0x0000000000000000-mapping.dmp
                  • memory/2368-46-0x0000000000000000-mapping.dmp
                  • memory/2376-242-0x0000000000000000-mapping.dmp
                  • memory/2420-47-0x0000000000000000-mapping.dmp
                  • memory/2440-48-0x0000000000000000-mapping.dmp
                  • memory/2448-478-0x0000000000000000-mapping.dmp
                  • memory/2464-49-0x0000000000000000-mapping.dmp
                  • memory/2484-50-0x0000000000000000-mapping.dmp
                  • memory/2496-51-0x0000000000000000-mapping.dmp
                  • memory/2508-52-0x0000000000000000-mapping.dmp
                  • memory/2520-53-0x0000000000000000-mapping.dmp
                  • memory/2540-54-0x0000000000000000-mapping.dmp
                  • memory/2552-55-0x0000000000000000-mapping.dmp
                  • memory/2596-56-0x0000000000000000-mapping.dmp
                  • memory/2624-57-0x0000000000000000-mapping.dmp
                  • memory/2636-371-0x0000000000000000-mapping.dmp
                  • memory/2656-58-0x0000000000000000-mapping.dmp
                  • memory/2668-59-0x0000000000000000-mapping.dmp
                  • memory/2680-60-0x0000000000000000-mapping.dmp
                  • memory/2692-61-0x0000000000000000-mapping.dmp
                  • memory/2724-62-0x0000000000000000-mapping.dmp
                  • memory/2736-63-0x0000000000000000-mapping.dmp
                  • memory/2756-64-0x0000000000000000-mapping.dmp
                  • memory/2768-260-0x0000000000000000-mapping.dmp
                  • memory/2800-65-0x0000000000000000-mapping.dmp
                  • memory/2832-66-0x0000000000000000-mapping.dmp
                  • memory/2844-79-0x0000000000000000-mapping.dmp
                  • memory/2848-67-0x0000000000000000-mapping.dmp
                  • memory/2856-68-0x0000000000000000-mapping.dmp
                  • memory/2876-69-0x0000000000000000-mapping.dmp
                  • memory/2888-419-0x0000000000000000-mapping.dmp
                  • memory/2900-209-0x0000000000000000-mapping.dmp
                  • memory/2908-70-0x0000000000000000-mapping.dmp
                  • memory/2916-229-0x0000000000000000-mapping.dmp
                  • memory/2920-71-0x0000000000000000-mapping.dmp
                  • memory/2928-261-0x0000000000000000-mapping.dmp
                  • memory/2936-72-0x0000000000000000-mapping.dmp
                  • memory/2948-73-0x0000000000000000-mapping.dmp
                  • memory/2980-94-0x0000000000000000-mapping.dmp
                  • memory/2984-74-0x0000000000000000-mapping.dmp
                  • memory/2996-75-0x0000000000000000-mapping.dmp
                  • memory/3012-76-0x0000000000000000-mapping.dmp
                  • memory/3020-93-0x0000000000000000-mapping.dmp
                  • memory/3032-77-0x0000000000000000-mapping.dmp
                  • memory/3044-78-0x0000000000000000-mapping.dmp
                  • memory/3128-211-0x0000000000000000-mapping.dmp
                  • memory/3148-80-0x0000000000000000-mapping.dmp
                  • memory/3156-337-0x0000000000000000-mapping.dmp
                  • memory/3160-81-0x0000000000000000-mapping.dmp
                  • memory/3232-95-0x0000000000000000-mapping.dmp
                  • memory/3240-82-0x0000000000000000-mapping.dmp
                  • memory/3248-185-0x0000000000000000-mapping.dmp
                  • memory/3296-83-0x0000000000000000-mapping.dmp
                  • memory/3360-201-0x0000000000000000-mapping.dmp
                  • memory/3376-216-0x0000000000000000-mapping.dmp
                  • memory/3388-233-0x0000000000000000-mapping.dmp
                  • memory/3448-456-0x0000000000000000-mapping.dmp
                  • memory/3456-354-0x0000000000000000-mapping.dmp
                  • memory/3472-314-0x0000000000000000-mapping.dmp
                  • memory/3476-344-0x0000000000000000-mapping.dmp
                  • memory/3488-84-0x0000000000000000-mapping.dmp
                  • memory/3500-398-0x0000000000000000-mapping.dmp
                  • memory/3508-375-0x0000000000000000-mapping.dmp
                  • memory/3524-356-0x0000000000000000-mapping.dmp
                  • memory/3544-214-0x0000000000000000-mapping.dmp
                  • memory/3548-224-0x0000000000000000-mapping.dmp
                  • memory/3576-496-0x0000000000000000-mapping.dmp
                  • memory/3640-85-0x0000000000000000-mapping.dmp
                  • memory/3744-86-0x0000000000000000-mapping.dmp
                  • memory/3752-249-0x0000000000000000-mapping.dmp
                  • memory/3764-380-0x0000000000000000-mapping.dmp
                  • memory/3780-87-0x0000000000000000-mapping.dmp
                  • memory/3872-250-0x0000000000000000-mapping.dmp
                  • memory/3900-96-0x0000000000000000-mapping.dmp
                  • memory/3904-396-0x0000000000000000-mapping.dmp
                  • memory/3916-311-0x0000000000000000-mapping.dmp
                  • memory/3920-228-0x0000000000000000-mapping.dmp
                  • memory/3924-265-0x0000000000000000-mapping.dmp
                  • memory/3952-88-0x0000000000000000-mapping.dmp
                  • memory/3968-238-0x0000000000000000-mapping.dmp
                  • memory/3972-89-0x0000000000000000-mapping.dmp
                  • memory/3992-90-0x0000000000000000-mapping.dmp
                  • memory/4008-97-0x0000000000000000-mapping.dmp
                  • memory/4016-520-0x0000000000000000-mapping.dmp
                  • memory/4024-405-0x0000000000000000-mapping.dmp
                  • memory/4044-91-0x0000000000000000-mapping.dmp
                  • memory/4060-92-0x0000000000000000-mapping.dmp
                  • memory/4080-275-0x0000000000000000-mapping.dmp
                  • memory/4100-98-0x0000000000000000-mapping.dmp
                  • memory/4112-199-0x0000000000000000-mapping.dmp
                  • memory/4116-99-0x0000000000000000-mapping.dmp
                  • memory/4140-100-0x0000000000000000-mapping.dmp
                  • memory/4168-208-0x0000000000000000-mapping.dmp
                  • memory/4172-101-0x0000000000000000-mapping.dmp
                  • memory/4188-102-0x0000000000000000-mapping.dmp
                  • memory/4200-384-0x0000000000000000-mapping.dmp
                  • memory/4204-103-0x0000000000000000-mapping.dmp
                  • memory/4216-104-0x0000000000000000-mapping.dmp
                  • memory/4256-414-0x0000000000000000-mapping.dmp
                  • memory/4260-105-0x0000000000000000-mapping.dmp
                  • memory/4272-106-0x0000000000000000-mapping.dmp
                  • memory/4300-107-0x0000000000000000-mapping.dmp
                  • memory/4320-108-0x0000000000000000-mapping.dmp
                  • memory/4328-212-0x0000000000000000-mapping.dmp
                  • memory/4336-340-0x0000000000000000-mapping.dmp
                  • memory/4388-109-0x0000000000000000-mapping.dmp
                  • memory/4400-110-0x0000000000000000-mapping.dmp
                  • memory/4408-111-0x0000000000000000-mapping.dmp
                  • memory/4420-114-0x0000000000000000-mapping.dmp
                  • memory/4432-113-0x0000000000000000-mapping.dmp
                  • memory/4440-112-0x0000000000000000-mapping.dmp
                  • memory/4448-115-0x0000000000000000-mapping.dmp
                  • memory/4524-191-0x0000000000000000-mapping.dmp
                  • memory/4528-116-0x0000000000000000-mapping.dmp
                  • memory/4536-168-0x0000000000000000-mapping.dmp
                  • memory/4552-204-0x0000000000000000-mapping.dmp
                  • memory/4576-231-0x0000000000000000-mapping.dmp
                  • memory/4588-162-0x0000000000000000-mapping.dmp
                  • memory/4600-190-0x0000000000000000-mapping.dmp
                  • memory/4612-189-0x0000000000000000-mapping.dmp
                  • memory/4632-352-0x0000000000000000-mapping.dmp
                  • memory/4688-119-0x0000000000000000-mapping.dmp
                  • memory/4696-489-0x0000000000000000-mapping.dmp
                  • memory/4720-536-0x0000000000000000-mapping.dmp
                  • memory/4728-360-0x0000000000000000-mapping.dmp
                  • memory/4732-319-0x0000000000000000-mapping.dmp
                  • memory/4744-244-0x0000000000000000-mapping.dmp
                  • memory/4748-213-0x0000000000000000-mapping.dmp
                  • memory/4836-266-0x0000000000000000-mapping.dmp
                  • memory/4844-395-0x0000000000000000-mapping.dmp
                  • memory/4856-227-0x0000000000000000-mapping.dmp
                  • memory/4868-286-0x0000000000000000-mapping.dmp
                  • memory/4876-121-0x0000000000000000-mapping.dmp
                  • memory/4908-462-0x0000000000000000-mapping.dmp
                  • memory/4940-203-0x0000000000000000-mapping.dmp
                  • memory/4948-256-0x0000000000000000-mapping.dmp
                  • memory/4976-326-0x0000000000000000-mapping.dmp
                  • memory/4992-338-0x0000000000000000-mapping.dmp
                  • memory/5000-207-0x0000000000000000-mapping.dmp
                  • memory/5012-172-0x0000000000000000-mapping.dmp
                  • memory/5048-363-0x0000000000000000-mapping.dmp
                  • memory/5052-243-0x0000000000000000-mapping.dmp
                  • memory/5064-436-0x0000000000000000-mapping.dmp
                  • memory/5068-222-0x0000000000000000-mapping.dmp
                  • memory/5072-258-0x0000000000000000-mapping.dmp
                  • memory/5076-180-0x0000000000000000-mapping.dmp
                  • memory/5132-241-0x0000000000000000-mapping.dmp
                  • memory/5152-219-0x0000000000000000-mapping.dmp
                  • memory/5188-235-0x0000000000000000-mapping.dmp
                  • memory/5192-220-0x0000000000000000-mapping.dmp
                  • memory/5232-316-0x0000000000000000-mapping.dmp
                  • memory/5244-257-0x0000000000000000-mapping.dmp
                  • memory/5260-364-0x0000000000000000-mapping.dmp
                  • memory/5264-378-0x0000000000000000-mapping.dmp
                  • memory/5268-236-0x0000000000000000-mapping.dmp
                  • memory/5288-322-0x0000000000000000-mapping.dmp
                  • memory/5312-205-0x0000000000000000-mapping.dmp
                  • memory/5348-386-0x0000000000000000-mapping.dmp
                  • memory/5412-226-0x0000000000000000-mapping.dmp
                  • memory/5424-230-0x0000000000000000-mapping.dmp
                  • memory/5448-210-0x0000000000000000-mapping.dmp
                  • memory/5452-341-0x0000000000000000-mapping.dmp
                  • memory/5460-359-0x0000000000000000-mapping.dmp
                  • memory/5488-246-0x0000000000000000-mapping.dmp
                  • memory/5492-381-0x0000000000000000-mapping.dmp
                  • memory/5496-262-0x0000000000000000-mapping.dmp
                  • memory/5516-313-0x0000000000000000-mapping.dmp
                  • memory/5560-400-0x0000000000000000-mapping.dmp
                  • memory/5564-234-0x0000000000000000-mapping.dmp
                  • memory/5580-200-0x0000000000000000-mapping.dmp
                  • memory/5628-397-0x0000000000000000-mapping.dmp
                  • memory/5728-303-0x0000000000000000-mapping.dmp
                  • memory/5744-264-0x0000000000000000-mapping.dmp
                  • memory/5748-365-0x0000000000000000-mapping.dmp
                  • memory/5752-387-0x0000000000000000-mapping.dmp
                  • memory/5756-483-0x0000000000000000-mapping.dmp
                  • memory/5776-125-0x0000000000000000-mapping.dmp
                  • memory/5800-342-0x0000000000000000-mapping.dmp
                  • memory/5824-192-0x0000000000000000-mapping.dmp
                  • memory/5840-247-0x0000000000000000-mapping.dmp
                  • memory/5872-232-0x0000000000000000-mapping.dmp
                  • memory/5884-457-0x0000000000000000-mapping.dmp
                  • memory/5920-166-0x0000000000000000-mapping.dmp
                  • memory/5956-376-0x0000000000000000-mapping.dmp
                  • memory/5976-270-0x0000000000000000-mapping.dmp
                  • memory/5988-328-0x0000000000000000-mapping.dmp
                  • memory/6064-393-0x0000000000000000-mapping.dmp
                  • memory/6128-394-0x0000000000000000-mapping.dmp
                  • memory/6132-218-0x0000000000000000-mapping.dmp
                  • memory/6148-128-0x0000000000000000-mapping.dmp
                  • memory/6160-239-0x0000000000000000-mapping.dmp
                  • memory/6164-124-0x0000000000000000-mapping.dmp
                  • memory/6172-126-0x0000000000000000-mapping.dmp
                  • memory/6180-145-0x0000000000000000-mapping.dmp
                  • memory/6220-546-0x0000000000000000-mapping.dmp
                  • memory/6224-137-0x0000000000000000-mapping.dmp
                  • memory/6232-141-0x0000000000000000-mapping.dmp
                  • memory/6244-135-0x0000000000000000-mapping.dmp
                  • memory/6256-148-0x0000000000000000-mapping.dmp
                  • memory/6268-132-0x0000000000000000-mapping.dmp
                  • memory/6276-147-0x0000000000000000-mapping.dmp
                  • memory/6296-131-0x0000000000000000-mapping.dmp
                  • memory/6308-129-0x0000000000000000-mapping.dmp
                  • memory/6340-133-0x0000000000000000-mapping.dmp
                  • memory/6352-136-0x0000000000000000-mapping.dmp
                  • memory/6360-139-0x0000000000000000-mapping.dmp
                  • memory/6376-134-0x0000000000000000-mapping.dmp
                  • memory/6384-362-0x0000000000000000-mapping.dmp
                  • memory/6400-156-0x0000000000000000-mapping.dmp
                  • memory/6412-186-0x0000000000000000-mapping.dmp
                  • memory/6420-169-0x0000000000000000-mapping.dmp
                  • memory/6428-167-0x0000000000000000-mapping.dmp
                  • memory/6440-142-0x0000000000000000-mapping.dmp
                  • memory/6452-184-0x0000000000000000-mapping.dmp
                  • memory/6464-206-0x0000000000000000-mapping.dmp
                  • memory/6476-159-0x0000000000000000-mapping.dmp
                  • memory/6524-138-0x0000000000000000-mapping.dmp
                  • memory/6544-187-0x0000000000000000-mapping.dmp
                  • memory/6560-140-0x0000000000000000-mapping.dmp
                  • memory/6568-188-0x0000000000000000-mapping.dmp
                  • memory/6580-161-0x0000000000000000-mapping.dmp
                  • memory/6596-444-0x0000000000000000-mapping.dmp
                  • memory/6600-183-0x0000000000000000-mapping.dmp
                  • memory/6624-146-0x0000000000000000-mapping.dmp
                  • memory/6636-390-0x0000000000000000-mapping.dmp
                  • memory/6644-461-0x0000000000000000-mapping.dmp
                  • memory/6648-153-0x0000000000000000-mapping.dmp
                  • memory/6656-357-0x0000000000000000-mapping.dmp
                  • memory/6660-155-0x0000000000000000-mapping.dmp
                  • memory/6668-174-0x0000000000000000-mapping.dmp
                  • memory/6680-144-0x0000000000000000-mapping.dmp
                  • memory/6688-143-0x0000000000000000-mapping.dmp
                  • memory/6696-157-0x0000000000000000-mapping.dmp
                  • memory/6712-154-0x0000000000000000-mapping.dmp
                  • memory/6720-152-0x0000000000000000-mapping.dmp
                  • memory/6744-151-0x0000000000000000-mapping.dmp
                  • memory/6756-150-0x0000000000000000-mapping.dmp
                  • memory/6764-181-0x0000000000000000-mapping.dmp
                  • memory/6776-160-0x0000000000000000-mapping.dmp
                  • memory/6784-179-0x0000000000000000-mapping.dmp
                  • memory/6796-240-0x0000000000000000-mapping.dmp
                  • memory/6812-170-0x0000000000000000-mapping.dmp
                  • memory/6836-197-0x0000000000000000-mapping.dmp
                  • memory/6844-193-0x0000000000000000-mapping.dmp
                  • memory/6864-320-0x0000000000000000-mapping.dmp
                  • memory/6876-177-0x0000000000000000-mapping.dmp
                  • memory/6900-345-0x0000000000000000-mapping.dmp
                  • memory/6904-171-0x0000000000000000-mapping.dmp
                  • memory/6912-332-0x0000000000000000-mapping.dmp
                  • memory/6916-335-0x0000000000000000-mapping.dmp
                  • memory/6920-254-0x0000000000000000-mapping.dmp
                  • memory/6936-165-0x0000000000000000-mapping.dmp
                  • memory/6944-164-0x0000000000000000-mapping.dmp
                  • memory/6968-333-0x0000000000000000-mapping.dmp
                  • memory/6976-163-0x0000000000000000-mapping.dmp
                  • memory/6984-331-0x0000000000000000-mapping.dmp
                  • memory/6988-178-0x0000000000000000-mapping.dmp
                  • memory/7000-198-0x0000000000000000-mapping.dmp
                  • memory/7016-383-0x0000000000000000-mapping.dmp
                  • memory/7036-175-0x0000000000000000-mapping.dmp
                  • memory/7044-304-0x0000000000000000-mapping.dmp
                  • memory/7056-358-0x0000000000000000-mapping.dmp
                  • memory/7072-196-0x0000000000000000-mapping.dmp
                  • memory/7096-158-0x0000000000000000-mapping.dmp
                  • memory/7136-182-0x0000000000000000-mapping.dmp
                  • memory/7192-373-0x0000000000000000-mapping.dmp
                  • memory/7200-388-0x0000000000000000-mapping.dmp
                  • memory/7236-272-0x0000000000000000-mapping.dmp
                  • memory/7252-353-0x0000000000000000-mapping.dmp
                  • memory/7260-518-0x0000000000000000-mapping.dmp
                  • memory/7268-413-0x0000000000000000-mapping.dmp
                  • memory/7304-285-0x0000000000000000-mapping.dmp
                  • memory/7348-291-0x0000000000000000-mapping.dmp
                  • memory/7368-284-0x0000000000000000-mapping.dmp
                  • memory/7376-355-0x0000000000000000-mapping.dmp
                  • memory/7380-542-0x0000000000000000-mapping.dmp
                  • memory/7404-330-0x0000000000000000-mapping.dmp
                  • memory/7448-267-0x0000000000000000-mapping.dmp
                  • memory/7456-276-0x0000000000000000-mapping.dmp
                  • memory/7476-534-0x0000000000000000-mapping.dmp
                  • memory/7488-283-0x0000000000000000-mapping.dmp
                  • memory/7500-278-0x0000000000000000-mapping.dmp
                  • memory/7508-349-0x0000000000000000-mapping.dmp
                  • memory/7524-268-0x0000000000000000-mapping.dmp
                  • memory/7532-298-0x0000000000000000-mapping.dmp
                  • memory/7572-273-0x0000000000000000-mapping.dmp
                  • memory/7580-263-0x0000000000000000-mapping.dmp
                  • memory/7588-309-0x0000000000000000-mapping.dmp
                  • memory/7596-377-0x0000000000000000-mapping.dmp
                  • memory/7600-374-0x0000000000000000-mapping.dmp
                  • memory/7608-295-0x0000000000000000-mapping.dmp
                  • memory/7620-315-0x0000000000000000-mapping.dmp
                  • memory/7628-282-0x0000000000000000-mapping.dmp
                  • memory/7636-339-0x0000000000000000-mapping.dmp
                  • memory/7640-280-0x0000000000000000-mapping.dmp
                  • memory/7648-367-0x0000000000000000-mapping.dmp
                  • memory/7656-281-0x0000000000000000-mapping.dmp
                  • memory/7664-297-0x0000000000000000-mapping.dmp
                  • memory/7672-277-0x0000000000000000-mapping.dmp
                  • memory/7680-317-0x0000000000000000-mapping.dmp
                  • memory/7688-348-0x0000000000000000-mapping.dmp
                  • memory/7692-274-0x0000000000000000-mapping.dmp
                  • memory/7700-310-0x0000000000000000-mapping.dmp
                  • memory/7712-287-0x0000000000000000-mapping.dmp
                  • memory/7720-294-0x0000000000000000-mapping.dmp
                  • memory/7728-525-0x0000000000000000-mapping.dmp
                  • memory/7732-279-0x0000000000000000-mapping.dmp
                  • memory/7740-271-0x0000000000000000-mapping.dmp
                  • memory/7748-290-0x0000000000000000-mapping.dmp
                  • memory/7756-541-0x0000000000000000-mapping.dmp
                  • memory/7760-327-0x0000000000000000-mapping.dmp
                  • memory/7768-293-0x0000000000000000-mapping.dmp
                  • memory/7800-292-0x0000000000000000-mapping.dmp
                  • memory/7808-391-0x0000000000000000-mapping.dmp
                  • memory/7820-379-0x0000000000000000-mapping.dmp
                  • memory/7832-336-0x0000000000000000-mapping.dmp
                  • memory/7840-324-0x0000000000000000-mapping.dmp
                  • memory/7852-366-0x0000000000000000-mapping.dmp
                  • memory/7860-289-0x0000000000000000-mapping.dmp
                  • memory/7868-385-0x0000000000000000-mapping.dmp
                  • memory/7884-422-0x0000000000000000-mapping.dmp
                  • memory/7888-318-0x0000000000000000-mapping.dmp
                  • memory/7900-329-0x0000000000000000-mapping.dmp
                  • memory/7912-288-0x0000000000000000-mapping.dmp
                  • memory/7920-299-0x0000000000000000-mapping.dmp
                  • memory/7928-347-0x0000000000000000-mapping.dmp
                  • memory/7936-308-0x0000000000000000-mapping.dmp
                  • memory/7952-539-0x0000000000000000-mapping.dmp
                  • memory/7956-321-0x0000000000000000-mapping.dmp
                  • memory/7964-351-0x0000000000000000-mapping.dmp
                  • memory/7976-306-0x0000000000000000-mapping.dmp
                  • memory/7984-323-0x0000000000000000-mapping.dmp
                  • memory/7996-301-0x0000000000000000-mapping.dmp
                  • memory/8004-302-0x0000000000000000-mapping.dmp
                  • memory/8012-346-0x0000000000000000-mapping.dmp
                  • memory/8020-296-0x0000000000000000-mapping.dmp
                  • memory/8028-350-0x0000000000000000-mapping.dmp
                  • memory/8044-312-0x0000000000000000-mapping.dmp
                  • memory/8064-515-0x0000000000000000-mapping.dmp
                  • memory/8148-307-0x0000000000000000-mapping.dmp
                  • memory/8156-334-0x0000000000000000-mapping.dmp
                  • memory/8176-305-0x0000000000000000-mapping.dmp
                  • memory/8184-325-0x0000000000000000-mapping.dmp
                  • memory/8228-435-0x0000000000000000-mapping.dmp
                  • memory/8404-487-0x0000000000000000-mapping.dmp
                  • memory/8504-446-0x0000000000000000-mapping.dmp
                  • memory/8760-545-0x0000000000000000-mapping.dmp
                  • memory/8788-389-0x0000000000000000-mapping.dmp
                  • memory/8800-453-0x0000000000000000-mapping.dmp
                  • memory/8856-449-0x0000000000000000-mapping.dmp
                  • memory/8892-402-0x0000000000000000-mapping.dmp
                  • memory/9208-527-0x0000000000000000-mapping.dmp
                  • memory/9280-493-0x0000000000000000-mapping.dmp
                  • memory/9296-499-0x0000000000000000-mapping.dmp
                  • memory/9300-428-0x0000000000000000-mapping.dmp
                  • memory/9404-425-0x0000000000000000-mapping.dmp
                  • memory/9472-430-0x0000000000000000-mapping.dmp
                  • memory/9480-485-0x0000000000000000-mapping.dmp
                  • memory/9524-403-0x0000000000000000-mapping.dmp
                  • memory/9544-404-0x0000000000000000-mapping.dmp
                  • memory/9572-410-0x0000000000000000-mapping.dmp
                  • memory/9576-482-0x0000000000000000-mapping.dmp
                  • memory/9584-486-0x0000000000000000-mapping.dmp
                  • memory/9620-420-0x0000000000000000-mapping.dmp
                  • memory/9668-447-0x0000000000000000-mapping.dmp
                  • memory/9720-471-0x0000000000000000-mapping.dmp
                  • memory/9756-511-0x0000000000000000-mapping.dmp
                  • memory/9788-408-0x0000000000000000-mapping.dmp
                  • memory/9800-415-0x0000000000000000-mapping.dmp
                  • memory/9812-417-0x0000000000000000-mapping.dmp
                  • memory/9820-399-0x0000000000000000-mapping.dmp
                  • memory/9848-401-0x0000000000000000-mapping.dmp
                  • memory/9880-451-0x0000000000000000-mapping.dmp
                  • memory/9916-411-0x0000000000000000-mapping.dmp
                  • memory/9936-454-0x0000000000000000-mapping.dmp
                  • memory/9956-463-0x0000000000000000-mapping.dmp
                  • memory/10028-470-0x0000000000000000-mapping.dmp
                  • memory/10160-424-0x0000000000000000-mapping.dmp
                  • memory/10164-439-0x0000000000000000-mapping.dmp
                  • memory/10212-538-0x0000000000000000-mapping.dmp
                  • memory/10256-434-0x0000000000000000-mapping.dmp
                  • memory/10296-437-0x0000000000000000-mapping.dmp
                  • memory/10304-469-0x0000000000000000-mapping.dmp
                  • memory/10328-418-0x0000000000000000-mapping.dmp
                  • memory/10340-535-0x0000000000000000-mapping.dmp
                  • memory/10372-450-0x0000000000000000-mapping.dmp
                  • memory/10420-519-0x0000000000000000-mapping.dmp
                  • memory/10492-459-0x0000000000000000-mapping.dmp
                  • memory/10532-466-0x0000000000000000-mapping.dmp
                  • memory/10536-412-0x0000000000000000-mapping.dmp
                  • memory/10600-441-0x0000000000000000-mapping.dmp
                  • memory/10612-442-0x0000000000000000-mapping.dmp
                  • memory/10680-480-0x0000000000000000-mapping.dmp
                  • memory/10696-547-0x0000000000000000-mapping.dmp
                  • memory/10724-445-0x0000000000000000-mapping.dmp
                  • memory/10832-490-0x0000000000000000-mapping.dmp
                  • memory/10848-426-0x0000000000000000-mapping.dmp
                  • memory/10928-526-0x0000000000000000-mapping.dmp
                  • memory/10988-468-0x0000000000000000-mapping.dmp
                  • memory/11012-514-0x0000000000000000-mapping.dmp
                  • memory/11136-528-0x0000000000000000-mapping.dmp
                  • memory/11184-523-0x0000000000000000-mapping.dmp
                  • memory/11196-510-0x0000000000000000-mapping.dmp
                  • memory/11212-476-0x0000000000000000-mapping.dmp
                  • memory/11244-431-0x0000000000000000-mapping.dmp
                  • memory/11272-529-0x0000000000000000-mapping.dmp
                  • memory/11292-549-0x0000000000000000-mapping.dmp
                  • memory/11316-501-0x0000000000000000-mapping.dmp
                  • memory/11328-517-0x0000000000000000-mapping.dmp
                  • memory/11356-506-0x0000000000000000-mapping.dmp
                  • memory/11380-530-0x0000000000000000-mapping.dmp
                  • memory/11416-544-0x0000000000000000-mapping.dmp
                  • memory/11432-556-0x0000000000000000-mapping.dmp
                  • memory/11484-553-0x0000000000000000-mapping.dmp
                  • memory/11520-533-0x0000000000000000-mapping.dmp
                  • memory/11532-492-0x0000000000000000-mapping.dmp
                  • memory/11552-543-0x0000000000000000-mapping.dmp
                  • memory/11556-516-0x0000000000000000-mapping.dmp
                  • memory/11568-498-0x0000000000000000-mapping.dmp
                  • memory/11572-509-0x0000000000000000-mapping.dmp
                  • memory/11592-548-0x0000000000000000-mapping.dmp
                  • memory/11616-481-0x0000000000000000-mapping.dmp
                  • memory/11648-555-0x0000000000000000-mapping.dmp
                  • memory/11760-540-0x0000000000000000-mapping.dmp
                  • memory/11788-512-0x0000000000000000-mapping.dmp
                  • memory/11812-479-0x0000000000000000-mapping.dmp
                  • memory/11860-495-0x0000000000000000-mapping.dmp
                  • memory/11900-491-0x0000000000000000-mapping.dmp
                  • memory/11936-500-0x0000000000000000-mapping.dmp
                  • memory/11972-508-0x0000000000000000-mapping.dmp
                  • memory/12004-552-0x0000000000000000-mapping.dmp
                  • memory/12080-537-0x0000000000000000-mapping.dmp
                  • memory/12092-522-0x0000000000000000-mapping.dmp
                  • memory/12232-513-0x0000000000000000-mapping.dmp
                  • memory/12248-504-0x0000000000000000-mapping.dmp
                  • memory/12620-550-0x0000000000000000-mapping.dmp
                  • memory/13000-551-0x0000000000000000-mapping.dmp