79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
4MB
25-11-2021 12:41
fe1de0acb3aa75f88f61a784288a32d1
d973f591f56c3d53aac4e2da4a3eede185c910d9
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10
Filter: none
-
Executes dropped EXE79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exe
Reported IOCs
pid process 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 764 jskit.exe -
Loads dropped DLL79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exeWerFault.exe
Reported IOCs
pid process 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 764 jskit.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Program crashWerFault.exe
Reported IOCs
pid pid_target process target process 1328 764 WerFault.exe jskit.exe -
Suspicious behavior: EnumeratesProcesses79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpWerFault.exe
Reported IOCs
pid process 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpamWerFault.exe
Reported IOCs
pid process 1328 WerFault.exe -
Suspicious use of AdjustPrivilegeTokenWerFault.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1328 WerFault.exe -
Suspicious use of FindShellTrayWindow79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
Reported IOCs
pid process 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp -
Suspicious use of WriteProcessMemory79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exe
Reported IOCs
description pid process target process PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe
-
C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exePID:1504"C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"Loads dropped DLLSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpPID:964"C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$80154,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"Executes dropped EXESuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exePID:1368"C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENTLoads dropped DLLSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpPID:1812"C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$5012A,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENTExecutes dropped EXELoads dropped DLLSuspicious behavior: EnumeratesProcessesSuspicious use of FindShellTrayWindowSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exePID:764"C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe"Executes dropped EXELoads dropped DLLSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exePID:1328C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 264Loads dropped DLLProgram crashSuspicious behavior: EnumeratesProcessesSuspicious behavior: GetForegroundWindowSpamSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
MD5eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
MD5eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dll
MD5958de7dd326bd45460ecb5082064df4c
SHA142e0da2a5c761641cfa2ff8d57ea21a3325f7606
SHA256f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c
SHA512dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894
-
\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
MD5eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
MD5eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
MD581acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dll
MD5958de7dd326bd45460ecb5082064df4c
SHA142e0da2a5c761641cfa2ff8d57ea21a3325f7606
SHA256f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c
SHA512dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894
-
memory/764-77-0x0000000000000000-mapping.dmp
-
memory/964-63-0x00000000001D0000-0x00000000001D1000-memory.dmp
-
memory/964-60-0x0000000000000000-mapping.dmp
-
memory/1328-81-0x0000000000000000-mapping.dmp
-
memory/1328-91-0x00000000006B0000-0x00000000006B1000-memory.dmp
-
memory/1368-69-0x0000000000400000-0x00000000004D8000-memory.dmp
-
memory/1368-64-0x0000000000000000-mapping.dmp
-
memory/1504-55-0x0000000075141000-0x0000000075143000-memory.dmp
-
memory/1504-58-0x0000000000400000-0x00000000004D8000-memory.dmp
-
memory/1812-73-0x0000000000240000-0x0000000000241000-memory.dmp
-
memory/1812-70-0x0000000000000000-mapping.dmp
-
memory/1812-74-0x0000000074391000-0x0000000074393000-memory.dmp