Analysis
- max time kernel
136s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 01:47
General
- Target b376e4858ece14f0459fc8f24e72bed8.exe
- Size 4.3MB
- Sample240305-b71zyaba3t
- SHA256 0a823cbd6a32a10c927253fa40466c8a3177e487ee7895a8a2e244a9b4c415fc
Malware Config
Extracted
-
redline
-
pab3
-
185.215.113.15:61506
Extracted
-
nullmixer
-
http://watira.xyz/
Extracted
-
vidar
-
40
-
706
-
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
-
smokeloader
-
pub5
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar Stealer 4 IoCs
- ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 13 IoCs
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 56 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 22 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b376e4858ece14f0459fc8f24e72bed8.exe"C:\Users\Admin\AppData\Local\Temp\b376e4858ece14f0459fc8f24e72bed8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon16299b35036.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon16299b35036.exeMon16299b35036.exe5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon16299b35036.exe"C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon16299b35036.exe" -a6⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon168eacf5abe6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon168eacf5abe6.exeMon168eacf5abe6.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon162a49cb298e25a7e.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon162a49cb298e25a7e.exeMon162a49cb298e25a7e.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon166f0c73c18054.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon166f0c73c18054.exeMon166f0c73c18054.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 8246⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 8326⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9046⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9126⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9926⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 11806⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 14886⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 15326⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 17846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 15166⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 16126⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 15926⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1634f04758a25c25c.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon1634f04758a25c25c.exeMon1634f04758a25c25c.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1623952f4e80cb7fc.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon1623952f4e80cb7fc.exeMon1623952f4e80cb7fc.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1663a63d10ba4bf8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon1663a63d10ba4bf8.exeMon1663a63d10ba4bf8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon16f128cd8075e.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon16f128cd8075e.exeMon16f128cd8075e.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Conservava.xlam6⤵
-
C:\Windows\SysWOW64\cmd.execmd7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^aXXPLdOdpKvHEwwcALYIInWmgGDtBFsVVodqfjpjFmFfheNjFpLslXxTwbAyMJPDzALcKwugCMepSGkjSsms$" Suoi.xlam8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Talune.exe.comTalune.exe.com K8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Talune.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Talune.exe.com K9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\PING.EXEping OAILVCNY -n 308⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon165996b67ab8c.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS83F8EBB7\Mon165996b67ab8c.exeMon165996b67ab8c.exe5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 4804⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 936 -ip 9361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3716 -ip 37161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3716 -ip 37161⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Mon1623952f4e80cb7fc.exe
Mon1623952f4e80cb7fc.exe
Mon16299b35036.exe
Mon162a49cb298e25a7e.exe
Mon1634f04758a25c25c.exe
Mon1634f04758a25c25c.exe
Mon165996b67ab8c.exe
Mon1663a63d10ba4bf8.exe
Mon1663a63d10ba4bf8.exe
Mon166f0c73c18054.exe
Mon166f0c73c18054.exe
Mon168eacf5abe6.exe
Mon168eacf5abe6.exe
Mon16f128cd8075e.exe
Mon16f128cd8075e.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
BearVpn 3.exe
Chrome 5.exe
Cercare.xlam
Conservava.xlam
K
Passaggio.xlam
Suoi.xlam
Talune.exe.com
Talune.exe.com
__PSScriptPolicyTest_mrdlwnsg.azh.ps1
dcc7975c8a99514da06323f0994cd79b.exe
setup_installer.exe
setup_installer.exe
setup_installer.exe
memory/936-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-132-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/936-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-198-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/936-59-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/936-63-0x00000000007A0000-0x000000000082F000-memory.dmp
memory/936-65-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/936-197-0x0000000000400000-0x000000000051B000-memory.dmp
memory/936-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-69-0x0000000064940000-0x0000000064959000-memory.dmp
memory/936-68-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/936-201-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/936-66-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/936-127-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/936-199-0x0000000064940000-0x0000000064959000-memory.dmp
memory/936-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-200-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/936-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-202-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/936-126-0x0000000000400000-0x000000000051B000-memory.dmp
memory/936-129-0x0000000064940000-0x0000000064959000-memory.dmp
memory/936-75-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/936-131-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/936-74-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1304-191-0x00007FFE893D0000-0x00007FFE89E91000-memory.dmp
memory/1304-98-0x00007FFE893D0000-0x00007FFE89E91000-memory.dmp
memory/1304-97-0x0000000000010000-0x0000000000034000-memory.dmp
memory/1304-99-0x0000000002090000-0x00000000020AC000-memory.dmp
memory/1304-121-0x000000001AC00000-0x000000001AC10000-memory.dmp
memory/1372-125-0x0000000007E70000-0x0000000008488000-memory.dmp
memory/1372-115-0x0000000073360000-0x0000000073B10000-memory.dmp
memory/1372-142-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/1372-122-0x00000000072A0000-0x0000000007844000-memory.dmp
memory/1372-143-0x00000000078D0000-0x000000000790C000-memory.dmp
memory/1372-146-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/1372-118-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/1372-123-0x0000000004DF0000-0x0000000004E10000-memory.dmp
memory/1372-116-0x0000000004A50000-0x0000000004A72000-memory.dmp
memory/1372-113-0x0000000002E30000-0x0000000002E5F000-memory.dmp
memory/1372-112-0x0000000002FE0000-0x00000000030E0000-memory.dmp
memory/1372-124-0x0000000000400000-0x0000000002CD3000-memory.dmp
memory/1372-203-0x0000000007AC0000-0x0000000007BCA000-memory.dmp
memory/1372-195-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/1372-192-0x0000000007930000-0x000000000797C000-memory.dmp
memory/1372-128-0x00000000078B0000-0x00000000078C2000-memory.dmp
memory/2136-190-0x0000000073360000-0x0000000073B10000-memory.dmp
memory/2136-100-0x0000000073360000-0x0000000073B10000-memory.dmp
memory/2136-110-0x0000000000D80000-0x0000000000D98000-memory.dmp
memory/2160-207-0x00000000047D0000-0x00000000047E0000-memory.dmp
memory/2160-227-0x0000000007680000-0x0000000007CFA000-memory.dmp
memory/2160-114-0x0000000004710000-0x0000000004746000-memory.dmp
memory/2160-246-0x0000000007230000-0x0000000007241000-memory.dmp
memory/2160-212-0x000000006EFB0000-0x000000006EFFC000-memory.dmp
memory/2160-178-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/2160-140-0x00000000047D0000-0x00000000047E0000-memory.dmp
memory/2160-234-0x00000000070B0000-0x00000000070BA000-memory.dmp
memory/2160-244-0x00000000072A0000-0x0000000007336000-memory.dmp
memory/2160-148-0x0000000004D20000-0x0000000004D42000-memory.dmp
memory/2160-204-0x0000000005B70000-0x0000000005B8E000-memory.dmp
memory/2160-111-0x0000000073360000-0x0000000073B10000-memory.dmp
memory/2160-251-0x0000000007260000-0x000000000726E000-memory.dmp
memory/2160-119-0x0000000004E10000-0x0000000005438000-memory.dmp
memory/2160-163-0x0000000005620000-0x0000000005686000-memory.dmp
memory/2160-211-0x00000000062D0000-0x0000000006302000-memory.dmp
memory/2160-222-0x0000000006290000-0x00000000062AE000-memory.dmp
memory/2160-224-0x0000000006CD0000-0x0000000006D73000-memory.dmp
memory/2160-242-0x000000007FA80000-0x000000007FA90000-memory.dmp
memory/2160-117-0x00000000047D0000-0x00000000047E0000-memory.dmp
memory/2160-193-0x0000000005800000-0x0000000005B54000-memory.dmp
memory/2160-228-0x0000000007030000-0x000000000704A000-memory.dmp
memory/3348-247-0x0000000000DB0000-0x0000000000DC6000-memory.dmp
memory/3716-225-0x0000000002EC0000-0x0000000002FC0000-memory.dmp
memory/3716-208-0x0000000000400000-0x0000000002D19000-memory.dmp
memory/3716-231-0x0000000000400000-0x0000000002D19000-memory.dmp
memory/3716-226-0x0000000004A10000-0x0000000004AAD000-memory.dmp
memory/3716-258-0x0000000000400000-0x0000000002D19000-memory.dmp
memory/4452-223-0x0000000000400000-0x0000000002CBE000-memory.dmp
memory/4452-233-0x0000000002F20000-0x0000000002F29000-memory.dmp
memory/4452-232-0x0000000002FA0000-0x00000000030A0000-memory.dmp
memory/4452-249-0x0000000000400000-0x0000000002CBE000-memory.dmp
memory/5592-147-0x0000000000B00000-0x0000000000B10000-memory.dmp
memory/5592-152-0x00007FFE893D0000-0x00007FFE89E91000-memory.dmp
memory/5704-180-0x00007FFE893D0000-0x00007FFE89E91000-memory.dmp
memory/5704-161-0x00000000008B0000-0x00000000008B8000-memory.dmp
memory/5828-206-0x0000000073360000-0x0000000073B10000-memory.dmp
memory/5828-196-0x0000000004F30000-0x0000000004F40000-memory.dmp
memory/5828-184-0x00000000005F0000-0x00000000005F8000-memory.dmp
memory/5828-194-0x0000000073360000-0x0000000073B10000-memory.dmp