Analysis
-
max time kernel
60s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 20:04
Static task
static1
Behavioral task
behavioral1
Sample
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe
Resource
win10v2004-20230220-en
General
-
Target
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe
-
Size
3.1MB
-
MD5
939800d328b8d8f9cd1188afb36dd960
-
SHA1
467963e9d84a2f1e39cd1c436b258ae6dc56f181
-
SHA256
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1
-
SHA512
8956b8bfaa0ba1dab5238ddb5e2daf71826d0f364975bb2c2205560c1de76cefcf2af1148eb8cb0bd730b7f248f5963969dec7fd4e86f01bb96ab09dde0c96aa
-
SSDEEP
98304:XKcQRF9EkcfWRRclPEzPFiwr3G9QJRJ2G:fazuh85iwr29uJR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe -
Executes dropped EXE 1 IoCs
Processes:
SDExtClient.exepid process 1488 SDExtClient.exe -
Loads dropped DLL 8 IoCs
Processes:
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exeSDExtClient.exepid process 2028 60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe 1488 SDExtClient.exe 1488 SDExtClient.exe 1488 SDExtClient.exe 1488 SDExtClient.exe 1488 SDExtClient.exe 1488 SDExtClient.exe 1488 SDExtClient.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exedescription ioc process File opened for modification \??\PhysicalDrive0 60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
SDExtClient.exepid process 1488 SDExtClient.exe 1488 SDExtClient.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exedescription pid process target process PID 2028 wrote to memory of 1488 2028 60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe SDExtClient.exe PID 2028 wrote to memory of 1488 2028 60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe SDExtClient.exe PID 2028 wrote to memory of 1488 2028 60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe SDExtClient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe"C:\Users\Admin\AppData\Local\Temp\60fce650fe921ff7b0b9045103f566c5a6984845c851a1240a7a3896cb53bfb1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDExtClient.exe"C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDExtClient.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\DecresePrint.exeFilesize
314KB
MD5b3603b9b5388f6ac61b54bf478b5c969
SHA19746d6e5749ae45a0d50bb65bfb8b64645da55e3
SHA256428b983c0b0b12f8fb8422408b0e7094f01b7ce11b807d353bbd17bb68133f30
SHA512bb5f14ec32e3a5b8c3d168c966f2a6f2bb5b66c50330cf4667316c38b4f2e856425dd48770a6c5e398cfe6b8d066db931fa4e6be120e988ed65273b0e1a06ced
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\ExePath.iniFilesize
116B
MD59bec551c6c989ad3464316faa95333ea
SHA1531765197ad06eb79df15c7677aa3c63f0a34807
SHA256b2795d09887d6761f5e2707a1b065d1b513acd031671c24981d3330d9d951248
SHA51219db679388c0901ee99e7a8817f33858e24f3a32402ae98065101d0c738da6be5778c0ac5479b9a2a5adfd5ca4afabbf1a0518d63086a42f109a2b5d8a567d95
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\ExePath\ExePath.iniFilesize
116B
MD59bec551c6c989ad3464316faa95333ea
SHA1531765197ad06eb79df15c7677aa3c63f0a34807
SHA256b2795d09887d6761f5e2707a1b065d1b513acd031671c24981d3330d9d951248
SHA51219db679388c0901ee99e7a8817f33858e24f3a32402ae98065101d0c738da6be5778c0ac5479b9a2a5adfd5ca4afabbf1a0518d63086a42f109a2b5d8a567d95
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FSPFileOut.dllFilesize
50KB
MD50310cfe97fafd9392c8926241a54002a
SHA135adc58c9c6c897a6f5d4c3b805324d970ff98dc
SHA256e9c27d7e6585626bff5f021a88ae295e78bbbbef573ba6787dd241457acf9c6c
SHA512ba37f45676fea851e2af585c884f942d030d2e97fee63b05bfc3820b7612fd7c10f77b2018a11ab6eb985160c04104a842a7021ed43115e46d79194e4321537b
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FSPFileOut.dllFilesize
50KB
MD50310cfe97fafd9392c8926241a54002a
SHA135adc58c9c6c897a6f5d4c3b805324d970ff98dc
SHA256e9c27d7e6585626bff5f021a88ae295e78bbbbef573ba6787dd241457acf9c6c
SHA512ba37f45676fea851e2af585c884f942d030d2e97fee63b05bfc3820b7612fd7c10f77b2018a11ab6eb985160c04104a842a7021ed43115e46d79194e4321537b
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FSPFileOut.sysFilesize
21KB
MD5c7046e9d79dad56500c7f01ea9b50317
SHA1dcac96f3327f0a6f42de883dfab4ae6f4c4ed4f6
SHA256c99863b250e9308ff2ba47e88dd5caad9c2e119e9a17ace88bb2a7bc7153c43c
SHA51226656cf83951da906fef954cb85919560888d5a4dc6fedff1a9876c654f2167a2851f85c203fb1da0bdab8d70d1e25194d26cb57031771d921ae606a480e3222
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FSPFileOut64.sysFilesize
24KB
MD5281fa560240cded410a958faab4f3a81
SHA173eefc8baa4cb8625fd177356607ca0a7539cbc5
SHA2564f795529d7b886b694e437c4793fbb20c2b039e8a8cd881f12b53755743e9f23
SHA5127ec626936e20f509e97defb61caeb5ff1f42e2c2a299c15af15f47107a078025d63fdd7310feba036ca1918dd0ae8359887dc8a0c83d5a25049a4b44fe95f410
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FSP_PrintLimit.dllFilesize
218KB
MD5d5b3279eb9b8058bcdd88a82d522979e
SHA1e90d0290ed8eed045db3b9c7cd1235bd2531e168
SHA2566f858a704d9840781e50e8b2af73e48a881fed3b67b88563026da90497f05e33
SHA512d79f046319558d162a4fcab70737d7045ea0bececa88a19d074271144619f9237cbd0dc41b19e09c853fdab03817f20314c5330082a44d0cb8a09ef22a464a96
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FSP_PrintLimit64.dllFilesize
253KB
MD58c0fe4eb0c0566dc6b578abf504c8e4f
SHA1f41f6e69101cb9e84835488dc3c4069db263d631
SHA256299f0fa7f59a7f3ca7ecbe08db3a9570d3d1cec95d4b787275ccd75c029ca2ab
SHA5125d7ad2b666a666e9b7f5ce6c95dab1f811a957d0917597f353c00a830b65f2f1b0924eee170f06514b34e843b0b3b98f9857329fcdd4c7abf58298ef0b4708cd
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\FileRedirectEx.dllFilesize
88KB
MD5f4cb091200c8aa6822c0ddfa8b1fc5ea
SHA1f19b7892aeb599597b3921d889bead8d67435c19
SHA25657a362dfe409d067ecf21796c2d10ae1ea487f7775dbb6b424c6e39f45d90a06
SHA5122e09302f01d6aaf011adc308485f3a9951ae1e52c3dca9bf8cbd8a45fefacb98330b9c79acb794dbcaa84fbce5558a85367a60ab7db82ea3fb075f256b4617e4
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\Fsp_Notice.dllFilesize
531KB
MD516ddd1e7aec3b76b06ad46c34c869ef5
SHA1c65d196c9d310f9e3733d7d726a5cbbefd4404d0
SHA2563e7a3c2d7483fbbb93eae2c87feb5dd7e25f73edd31612aaa7966ad364a6be4d
SHA512d06d7a975535b7ec8062fd8a9a5e6524c01f31fe4161ada02182f21e3a6c6711f3e4ea23d5930758527ef3db4f23f1d6170f2bd664542887db14b336a3acbc34
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\Fsp_Notice.dllFilesize
531KB
MD516ddd1e7aec3b76b06ad46c34c869ef5
SHA1c65d196c9d310f9e3733d7d726a5cbbefd4404d0
SHA2563e7a3c2d7483fbbb93eae2c87feb5dd7e25f73edd31612aaa7966ad364a6be4d
SHA512d06d7a975535b7ec8062fd8a9a5e6524c01f31fe4161ada02182f21e3a6c6711f3e4ea23d5930758527ef3db4f23f1d6170f2bd664542887db14b336a3acbc34
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\ImpControl.dllFilesize
37KB
MD5e88bfbe7e63480f1e69769384e918578
SHA196ccd80e5d28acbb528da416ec7f30b4138306f9
SHA256226d470e7cfcd5e319a3c1a610f3c7e9b6d26377af902c9b73fc6f30097be634
SHA51290fc5327774c1e382793deb53fdf9ae58aa66186c4ed68723a38b0e4399c3d733ddb8aafcbbbc946e9a86ea82c6285201e2861300537cb4044de4b9cd31ffc06
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\LoaderInterface.dllFilesize
60KB
MD5f5f001ca8cdac172286ffaeaf1ab4e13
SHA1e89b2b326084a286ea57aa76ed0138baf9d6c9a6
SHA256cd85db8ae064cc14c38892ca632073a7d9d1880abc08c5854bfb3d89f83f7eef
SHA512f98446e039e6f788dc2bc8b24cecb40c53fded01d6a08aec12f18977df0fde566cafaeec3db26c1b5c4d23de28194656985e958b14c1b02bb91c969f104e7a59
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\LoaderInterface.dllFilesize
60KB
MD5f5f001ca8cdac172286ffaeaf1ab4e13
SHA1e89b2b326084a286ea57aa76ed0138baf9d6c9a6
SHA256cd85db8ae064cc14c38892ca632073a7d9d1880abc08c5854bfb3d89f83f7eef
SHA512f98446e039e6f788dc2bc8b24cecb40c53fded01d6a08aec12f18977df0fde566cafaeec3db26c1b5c4d23de28194656985e958b14c1b02bb91c969f104e7a59
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDCommon.dllFilesize
71KB
MD5e21b7c64b236181645ea7e3d26e7a928
SHA1c73c82ce09f10e3604c0c12fe5e13f0a51c921b5
SHA25637d14827cf93ba1cad060c8c5c0d2576d96d9230efb1201b7cc19f98d6020b0c
SHA51255e2440c968593e6bcc5586c81bff9a2a6516b0a99ddec3ef2e07afc03a384ec5a00dd1d48106f881ebeb1a1a418cb3d255ba665ddc27d80026a66c936e0a94f
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDCommon.dllFilesize
71KB
MD5e21b7c64b236181645ea7e3d26e7a928
SHA1c73c82ce09f10e3604c0c12fe5e13f0a51c921b5
SHA25637d14827cf93ba1cad060c8c5c0d2576d96d9230efb1201b7cc19f98d6020b0c
SHA51255e2440c968593e6bcc5586c81bff9a2a6516b0a99ddec3ef2e07afc03a384ec5a00dd1d48106f881ebeb1a1a418cb3d255ba665ddc27d80026a66c936e0a94f
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDCommonEx.dllFilesize
199KB
MD5534ebb974cabdb64b5503b4727877024
SHA1bc571ac14dadbf43770d68facca2b0953cd9ed05
SHA256748aa576deffe0b93a5e446d01e53cddf52d38bf6a6ea6252d636326e7a4340b
SHA51251a6a2d0b2b283faeffeaf3879d84ab37b72916b951eb41f9439a2486fef135c0c91f539541d158e63e2393a1ba5370075bf8e586ee38d82e9a4b1d7b2ec0207
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDCommonEx.dllFilesize
199KB
MD5534ebb974cabdb64b5503b4727877024
SHA1bc571ac14dadbf43770d68facca2b0953cd9ed05
SHA256748aa576deffe0b93a5e446d01e53cddf52d38bf6a6ea6252d636326e7a4340b
SHA51251a6a2d0b2b283faeffeaf3879d84ab37b72916b951eb41f9439a2486fef135c0c91f539541d158e63e2393a1ba5370075bf8e586ee38d82e9a4b1d7b2ec0207
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDExtClient.exeFilesize
2.9MB
MD5c2b721bf5ba2e41588304d553bfa3466
SHA1b6a09708706112871d795a2b4d8ba8f85f667fab
SHA256bdaff354d371b36595e2007fdbb8e2bce270a581a2bb2fec9d5b7bd02491e103
SHA512b37344c1a24eee2c1e5971e26a735bc430db62783485f494b9d7147ac9855d36613a4c511f4d26d5d5c03fe0b8ddc8156f66892b982298b3b7b722f4d558d3a4
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDExtClient.exeFilesize
2.9MB
MD5c2b721bf5ba2e41588304d553bfa3466
SHA1b6a09708706112871d795a2b4d8ba8f85f667fab
SHA256bdaff354d371b36595e2007fdbb8e2bce270a581a2bb2fec9d5b7bd02491e103
SHA512b37344c1a24eee2c1e5971e26a735bc430db62783485f494b9d7147ac9855d36613a4c511f4d26d5d5c03fe0b8ddc8156f66892b982298b3b7b722f4d558d3a4
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDExtClient.exeFilesize
2.9MB
MD5c2b721bf5ba2e41588304d553bfa3466
SHA1b6a09708706112871d795a2b4d8ba8f85f667fab
SHA256bdaff354d371b36595e2007fdbb8e2bce270a581a2bb2fec9d5b7bd02491e103
SHA512b37344c1a24eee2c1e5971e26a735bc430db62783485f494b9d7147ac9855d36613a4c511f4d26d5d5c03fe0b8ddc8156f66892b982298b3b7b722f4d558d3a4
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDExtPolicy.lstFilesize
3KB
MD598fe57e21a33dbb43964b8aff7c7352f
SHA1f27331e1a3f13a488911a0b1a65b7bdaa2914fee
SHA2563882588b50946be86be93e0128dd689a04a5175c31c12ce8c97934fdbb97390c
SHA512582e8c9c9495344f1f7f5cb3f2a520ec8144c6a34a36d5cba2d442a6219c5913ec4eb970d11fed2bf10eb53725a22d4aab4e92b1884e3650fed0d219cdfe6e7c
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDOutHook.dllFilesize
208KB
MD5017d3bd42d580fe02506b374117f154d
SHA1443ba02d89382f044c69e64f8bbedef1abbf3e51
SHA256ddbb5ce5819ca1d94c41439c4ab6c8153645ffebb9636e1e74e24818cf74dd15
SHA5123ea3650e3b1b45666670ee64801013d9b8ad5b40899cdd8552b6bede664360a7a357f6554603ff9c5e1d281ad981fb516d779f334a574ae90e14f0ef3e430d69
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDOutHook64.dllFilesize
239KB
MD5795cc642f6e52640fe10a7f2301c349b
SHA1dfa77691d63baa21ceafc987ab4f09764f8db572
SHA256af87a1378c2c669558a66f5d6ee1a2c5d9c0cac69eef9c8aa881fd65c0e9a524
SHA5125887cfde99927f2fedc851ea9741f17d2551ff3eccbf35350e2fb3a06a6b03df577a2599699a6078cfd36d7b68ac185a371dff87840736c2081d57090c3dd530
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDOutHookLoader.exeFilesize
85KB
MD574fb536b7d928ab6baf698fb44922a9f
SHA1a597e9d4f1d66097e7e20dbe46207d255e6722af
SHA2561fab3a8b8e043aa91c17316927396e647d757c7705a3ad724c68de5546793876
SHA5126ced3265556731748640332e7192bd18cfd5a78f363afc41bb30e283372173adef041c5dd4243c221f95eadf51864c1a63d9975394f2abedb46f470aa78f9bd5
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SDOutHookLoader64.exeFilesize
94KB
MD59a9678b6a44ad0187bdf44482261cbfb
SHA1b349453262d332703c9036965f10fad9b49b2ce3
SHA2568e6a8424173c14a7b897f1af8385578c9c8ce1887c708a9999b37b82b1ae4ce7
SHA5128c7fd316d5361f4e5c0dadeea9b5f9d2aa554c319d8438852a20f59073d38386d92132dfada3365311fc13f31cd4f9f62ef1ce3436bb43e1e8194d854a5dee6c
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SD_AssistP.dllFilesize
76KB
MD5b3f3758a563104345e37498579f91e39
SHA1e4130c49b342dd6aa8bba85ba89d6d519ed1a194
SHA25605bd3f7342b60405a37da0ad0f7f68a6a7cc9ab5482747fad08e8fdfb2f7a9b9
SHA51267e104d1e99b31b601c69354e4b2f562e01e7ac37305043c93f85b852a9befd6ccd2aef9736f2c1509ef823ccd78361cff0612236ea7a27a4daf9ead9e731ad1
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SD_AssistP.dllFilesize
76KB
MD5b3f3758a563104345e37498579f91e39
SHA1e4130c49b342dd6aa8bba85ba89d6d519ed1a194
SHA25605bd3f7342b60405a37da0ad0f7f68a6a7cc9ab5482747fad08e8fdfb2f7a9b9
SHA51267e104d1e99b31b601c69354e4b2f562e01e7ac37305043c93f85b852a9befd6ccd2aef9736f2c1509ef823ccd78361cff0612236ea7a27a4daf9ead9e731ad1
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\SelfExtract.exeFilesize
1004KB
MD58bdcb2c5a3eb175394deb0d90bcc8263
SHA1e6f8aa5332a989e69c246ba78f6783c58ac4cfa4
SHA256859b923457c7c084008e2fcf75e6dd309f24d1b3f93514c08e73d9469fccddd6
SHA51294310458b6b165192b61dfd1cbdb9e87e05e2d704464b143a39773f9838a5db967954a7c0d2c03a0e258ecd62932875533b811bea5d1d99e57a2cc0d8e40832b
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\csp_crypto_dll.dllFilesize
76KB
MD5c644949671ca7e0c5055207a0a4c45ab
SHA1523705caa026c77b082c25d6c5b64d0e3fd6d2ee
SHA25630d763349c73cd39411406fa2f4aab5edda2394b9d8e200a7df86d1e39cecc0f
SHA5127260574b09a059e45c06f62c9166858a42d37d1ca54a2f7cda2de2d6dafad44923bbf7649cb213e026ea3f6f74479514c0badb6f954e1e534c1dfd465608ccd4
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\csp_crypto_dll.dllFilesize
76KB
MD5c644949671ca7e0c5055207a0a4c45ab
SHA1523705caa026c77b082c25d6c5b64d0e3fd6d2ee
SHA25630d763349c73cd39411406fa2f4aab5edda2394b9d8e200a7df86d1e39cecc0f
SHA5127260574b09a059e45c06f62c9166858a42d37d1ca54a2f7cda2de2d6dafad44923bbf7649cb213e026ea3f6f74479514c0badb6f954e1e534c1dfd465608ccd4
-
C:\Users\Admin\AppData\Local\Temp\SD_BE36\csp_soft.dllFilesize
136KB
MD5a7c97559d7137d256c4df9725fbd30db
SHA1b66a0d1308d532bfa5b766a9aa7922c1d71a436f
SHA256fdac77981aa42256b881f29365079801385fce16d5a095e8321611cb22480eb5
SHA512fdf7c804b139b88e80defd2fd6dd015acadecad267c9330ba23bdf0b47197cc6a1a185b4cc14eee6c45a942630036db736081e1db578dc6dcb454454811dc762
-
C:\Users\Admin\AppData\Local\Temp\evbBDF7.tmpFilesize
1KB
MD5607f71634812be52285b38bf5e1045da
SHA1fc6c1be4daf417a58528441f9d8f4e3deef5a729
SHA2568473b73da507b05ce3bf000c831f9e4227a8efbae8df2ff774bebd4932ab2bb5
SHA512dde318c9852827cc65079a2921d2bf47691d670421946426e59f98066f018266119b728da5bb77d311274e689004e99786e3edf1edb315178652eda161bc4b5f
-
memory/2028-133-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/2028-137-0x0000000010000000-0x0000000010038000-memory.dmpFilesize
224KB
-
memory/2028-193-0x0000000010000000-0x0000000010038000-memory.dmpFilesize
224KB
-
memory/2028-205-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/2028-207-0x0000000010000000-0x0000000010038000-memory.dmpFilesize
224KB