Malware Analysis Report

2024-11-30 16:02

Sample ID 220615-trarxsehdr
Target 28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788
SHA256 28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788

Threat Level: Known bad

The file 28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788 was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-15 16:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-15 16:16

Reported

2022-06-15 20:38

Platform

win7-20220414-en

Max time kernel

141s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe"

Signatures

Imminent RAT

trojan spyware imminent

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 664 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe

Processes

C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe

"C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe"

C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe

"C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe"

C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe

"C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x51c

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp

Files

memory/664-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

memory/664-55-0x0000000074580000-0x0000000074B2B000-memory.dmp

\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe

MD5 a08d8b4101519dc1fda3b19687f794c5
SHA1 56258f9eb8d66902b61bf711f3c6c08c946d9deb
SHA256 54bf9eb1a89bb1579800ca524e34a1c5411458e0fce86b166521e50a6fe0c652
SHA512 20f6d1c4b8865c8bf71be75cea71119aa3feb7bb469cd6134b5cbefbf0740077f130189c52d67c7f1c8d3bfa6b41fb035a0ceef9510b0ef671466af8d15e6851

memory/1984-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe

MD5 a08d8b4101519dc1fda3b19687f794c5
SHA1 56258f9eb8d66902b61bf711f3c6c08c946d9deb
SHA256 54bf9eb1a89bb1579800ca524e34a1c5411458e0fce86b166521e50a6fe0c652
SHA512 20f6d1c4b8865c8bf71be75cea71119aa3feb7bb469cd6134b5cbefbf0740077f130189c52d67c7f1c8d3bfa6b41fb035a0ceef9510b0ef671466af8d15e6851

\Users\Admin\AppData\Local\Temp\dup2patcher.dll

MD5 97aedd5a683b05e0e48cb6b65b74eacf
SHA1 08c9cc1aaddb2843d4c6c4495aa21df1269ba18f
SHA256 3310f031e2ca4fda494eb49b386fa33d63cbc797a1244d6a0350f80656e97e26
SHA512 83c1f3a0b87407cbd403fc2dd66ee0676b01826085e8ba2e7349ce855da8442ad8a3f9021f10c4cd7dd31761571277eb3451ac1c05e5a8ed6b05624fb6a4d6e9

memory/664-61-0x0000000074580000-0x0000000074B2B000-memory.dmp

memory/1984-62-0x00000000717B0000-0x000000007183C000-memory.dmp

\Users\Admin\AppData\Local\Temp\bassmod.dll

MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

memory/1984-64-0x0000000010000000-0x0000000010013000-memory.dmp

memory/1984-66-0x0000000010000000-0x0000000010013000-memory.dmp

memory/1756-65-0x0000000000402000-0x0000000000493C00-memory.dmp

memory/1756-68-0x0000000000400000-0x0000000000401000-memory.dmp

memory/1756-70-0x0000000000402000-0x0000000000493C00-memory.dmp

memory/1756-67-0x0000000000400000-0x0000000000401000-memory.dmp

memory/1756-72-0x0000000074580000-0x0000000074B2B000-memory.dmp

memory/664-73-0x0000000074580000-0x0000000074B2B000-memory.dmp

memory/1756-74-0x0000000074580000-0x0000000074B2B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-15 16:16

Reported

2022-06-15 20:38

Platform

win10v2004-20220414-en

Max time kernel

152s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe"

Signatures

Imminent RAT

trojan spyware imminent

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2964 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 2964 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 2964 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe
PID 2964 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe

Processes

C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe

"C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe"

C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe

"C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x320 0x2f8

C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe

"C:\Users\Admin\AppData\Local\Temp\28d9e1599d9929493db8c12a48029f33d60e6017a2aced3920dce8fae1b00788.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 13.89.178.27:443 tcp
NL 104.109.143.11:80 tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 209.197.3.8:80 tcp
NL 88.221.144.179:80 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
NL 104.109.143.9:80 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp
SG 139.59.234.62:2443 tcp

Files

memory/2964-130-0x0000000074930000-0x0000000074EE1000-memory.dmp

memory/2964-131-0x0000000074930000-0x0000000074EE1000-memory.dmp

memory/4376-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe

MD5 a08d8b4101519dc1fda3b19687f794c5
SHA1 56258f9eb8d66902b61bf711f3c6c08c946d9deb
SHA256 54bf9eb1a89bb1579800ca524e34a1c5411458e0fce86b166521e50a6fe0c652
SHA512 20f6d1c4b8865c8bf71be75cea71119aa3feb7bb469cd6134b5cbefbf0740077f130189c52d67c7f1c8d3bfa6b41fb035a0ceef9510b0ef671466af8d15e6851

C:\Users\Admin\AppData\Roaming\ransomware.defender.v.3.5.7-patch.exe

MD5 a08d8b4101519dc1fda3b19687f794c5
SHA1 56258f9eb8d66902b61bf711f3c6c08c946d9deb
SHA256 54bf9eb1a89bb1579800ca524e34a1c5411458e0fce86b166521e50a6fe0c652
SHA512 20f6d1c4b8865c8bf71be75cea71119aa3feb7bb469cd6134b5cbefbf0740077f130189c52d67c7f1c8d3bfa6b41fb035a0ceef9510b0ef671466af8d15e6851

C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

MD5 97aedd5a683b05e0e48cb6b65b74eacf
SHA1 08c9cc1aaddb2843d4c6c4495aa21df1269ba18f
SHA256 3310f031e2ca4fda494eb49b386fa33d63cbc797a1244d6a0350f80656e97e26
SHA512 83c1f3a0b87407cbd403fc2dd66ee0676b01826085e8ba2e7349ce855da8442ad8a3f9021f10c4cd7dd31761571277eb3451ac1c05e5a8ed6b05624fb6a4d6e9

memory/4376-136-0x0000000071BD0000-0x0000000071C5C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

memory/4376-138-0x0000000010000000-0x0000000010013000-memory.dmp

memory/4488-139-0x0000000000000000-mapping.dmp

memory/4376-140-0x0000000010000000-0x0000000010013000-memory.dmp

memory/4488-142-0x0000000074930000-0x0000000074EE1000-memory.dmp

memory/2964-143-0x0000000074930000-0x0000000074EE1000-memory.dmp

memory/4488-144-0x0000000074930000-0x0000000074EE1000-memory.dmp

memory/4376-145-0x0000000071BD0000-0x0000000071C5C000-memory.dmp