Analysis
-
max time kernel
4294225s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
20-03-2022 03:34
Static task
static1
Behavioral task
behavioral1
Sample
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe
Resource
win10v2004-en-20220113
General
-
Target
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe
-
Size
3.2MB
-
MD5
562a9f62a55034e9c8aa9bbfa9850b16
-
SHA1
3b23806194ebfd8ba2215a0f11d9b0199791fe80
-
SHA256
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff
-
SHA512
896b605c64f97323402cf45d2f0f505fd518344b9e96971a3b46d8ab972d7b8fbc48ac6d02d3c2e29da0311f37f97181eb1b6b2e79a3036d4ff02d22f4b86ce6
Malware Config
Extracted
njrat
im523
hacker
2.tcp.ngrok.io:17639
7cf40e6a3924b89f8051713ab507eec7
-
reg_key
7cf40e6a3924b89f8051713ab507eec7
-
splitter
|'|'|
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 3 IoCs
Processes:
CDS.execrypted.exesvchost.exepid process 1060 CDS.exe 1056 crypted.exe 1464 svchost.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cf40e6a3924b89f8051713ab507eec7.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cf40e6a3924b89f8051713ab507eec7.exe svchost.exe -
Loads dropped DLL 10 IoCs
Processes:
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exeCDS.execrypted.exesvchost.exepid process 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe 1060 CDS.exe 1060 CDS.exe 1060 CDS.exe 1060 CDS.exe 1060 CDS.exe 1060 CDS.exe 1056 crypted.exe 1056 crypted.exe 1464 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exea0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7cf40e6a3924b89f8051713ab507eec7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\7cf40e6a3924b89f8051713ab507eec7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exeCDS.exepid process 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1060 CDS.exe 1060 CDS.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe 1464 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 1464 svchost.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe Token: 33 1464 svchost.exe Token: SeIncBasePriorityPrivilege 1464 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
CDS.exepid process 1060 CDS.exe 1060 CDS.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exeCDS.execrypted.exesvchost.exedescription pid process target process PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1828 wrote to memory of 1060 1828 a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe CDS.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1060 wrote to memory of 1056 1060 CDS.exe crypted.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1056 wrote to memory of 1464 1056 crypted.exe svchost.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe PID 1464 wrote to memory of 988 1464 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe"C:\Users\Admin\AppData\Local\Temp\a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\630_10.pngMD5
340b294efc691d1b20c64175d565ebc7
SHA181cb9649bd1c9a62ae79e781818fc24d15c29ce7
SHA25672566894059452101ea836bbff9ede5069141eeb52022ab55baa24e1666825c9
SHA5121395a8e175c63a1a1ff459a9dac437156c74299272e020e7e078a087969251a8534f17244a529acbc1b6800a97d4c0abfa3c88f6fcb88423f56dfaae9b49fc3d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.cddMD5
3e7ecaeb51c2812d13b07ec852d74aaf
SHA1e9bdab93596ffb0f7f8c65243c579180939acb26
SHA256e7e942993864e8b18780ef10a415f7b93924c6378248c52f0c96895735222b96
SHA512635cd5173b595f1905af9eeea65037601cf8496d519c506b6d082662d438c26a1bfe653eaf6edcb117ccf8767975c37ab0238ca4c77574e2706f9b238a15ad4d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c.datMD5
32687f1be72453b7719a386a0cdb84ca
SHA11da4226e6fd96db2a0e891dce2a95a13efd19e9a
SHA256d2ad96351f6c8178149cb1d7d15a476e9c1064681f2499ba10a557740d0ae605
SHA5120d5cb84f46b1ecdeb1c08ff82d304eace186003d9de1849d5772d332c5779596bb24dec3cf89f6eff21914c5a509a541eaed03f08781ef9598cc38bcf4850340
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fs.settingsMD5
68934a3e9455fa72420237eb05902327
SHA17cb6efb98ba5972a9b5090dc2e517fe14d12cb04
SHA256fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa
SHA512719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllMD5
c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeMD5
424bf196deaeb4ddcafb78e137fa560a
SHA1007738e9486c904a3115daa6e8ba2ee692af58c8
SHA2560963cef2f742a31b2604fe975f4471ae6a76641490fe60805db744fef9bdd5d2
SHA512a9be6dd5b2ed84baea34e0f1b1e8f5388ce3662c5dcb6a80c2d175be95f9598312837420c07b52cdfaa9e94bcffd8c7a2b9db2b551dfac171bce4b92f466e797
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\lua5.1.dllMD5
c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
0a625d6ba8cb88acfcdfc589424d11c5
SHA128eacd9a15b0bb1d72e5f4303f33087deb7284c3
SHA2566d9f82bb77aa90c3d21c890cb8105f3978916031a444bcdd81cd52de6edd2f82
SHA51220bd27ad19f066dbe89d359c83de64678d9d1b796ff218b689cd137b9dd88632af182b0307352179ce5b3fc06750286eaee6495547c98fe538fdde49d53f1cb9
-
memory/1056-75-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/1056-74-0x0000000072D10000-0x00000000732BB000-memory.dmpFilesize
5.7MB
-
memory/1464-82-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/1464-81-0x0000000072760000-0x0000000072D0B000-memory.dmpFilesize
5.7MB
-
memory/1828-54-0x0000000075081000-0x0000000075083000-memory.dmpFilesize
8KB