Malware Analysis Report

2024-11-13 15:03

Sample ID 240314-epva8aaa8s
Target 1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518
SHA256 1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518
Tags
lockbit ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518

Threat Level: Known bad

The file 1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518 was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware

Lockbit

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 04:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 04:07

Reported

2024-03-14 04:09

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1

Signatures

Lockbit

ransomware lockbit

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\BB4.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2196 wrote to memory of 1780 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1780 wrote to memory of 1392 N/A C:\Windows\SysWOW64\rundll32.exe C:\ProgramData\BB4.tmp
PID 1780 wrote to memory of 1392 N/A C:\Windows\SysWOW64\rundll32.exe C:\ProgramData\BB4.tmp
PID 1780 wrote to memory of 1392 N/A C:\Windows\SysWOW64\rundll32.exe C:\ProgramData\BB4.tmp
PID 1780 wrote to memory of 1392 N/A C:\Windows\SysWOW64\rundll32.exe C:\ProgramData\BB4.tmp
PID 1780 wrote to memory of 1392 N/A C:\Windows\SysWOW64\rundll32.exe C:\ProgramData\BB4.tmp
PID 1392 wrote to memory of 2324 N/A C:\ProgramData\BB4.tmp C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2324 N/A C:\ProgramData\BB4.tmp C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2324 N/A C:\ProgramData\BB4.tmp C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 2324 N/A C:\ProgramData\BB4.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1

C:\ProgramData\BB4.tmp

"C:\ProgramData\BB4.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BB4.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/1780-0-0x0000000000910000-0x0000000000950000-memory.dmp

C:\Users\ndVkYtjAf.README.txt

MD5 fca975e2563293f289d47a8c9fe897af
SHA1 09de20439fbf20d936baa6ac0cebccbf34ef87cf
SHA256 301600771cf58007cab8b74a95c4c5549f18e4cf86cf332b0545bfa4cae9e5aa
SHA512 0b3c9882465e879ac55a621189f5597051cde4658126be290f7fd0ac274b9a5f9fe362866f485298ca6743e32a50c39f9a68b6af05363987c3513dd7a67c4c7c

\ProgramData\BB4.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1392-208-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1780-210-0x0000000000C85000-0x0000000000CBD000-memory.dmp

memory/1392-209-0x00000000020F0000-0x0000000002130000-memory.dmp

memory/1392-206-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1780-211-0x0000000000CBD000-0x0000000000CC0000-memory.dmp

memory/1392-214-0x00000000020F0000-0x0000000002130000-memory.dmp

memory/1392-212-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1392-213-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/1392-215-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1392-216-0x00000000020F0000-0x0000000002130000-memory.dmp

memory/1392-219-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/1392-220-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/1392-221-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 04:07

Reported

2024-03-14 04:10

Platform

win10v2004-20240226-en

Max time kernel

92s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1

Signatures

Lockbit

ransomware lockbit

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1408 wrote to memory of 4148 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 4148 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1408 wrote to memory of 4148 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/4148-0-0x0000000002A80000-0x0000000002A90000-memory.dmp

memory/4148-1-0x0000000002A80000-0x0000000002A90000-memory.dmp

memory/4148-2-0x0000000002A80000-0x0000000002A90000-memory.dmp

C:\Users\ndVkYtjAf.README.txt

MD5 fcf663a3d65220f447d7f71736c1da6b
SHA1 a228033f688c719c77ded0eceb3600d49fc07c09
SHA256 f37d783c7a54ac8e05b17c601d28f8941ab26354c583d45a008d256d9031192b
SHA512 d3eb447ca020522830a73c501794ed2af72ba25d574d987a7f104fb856c0c14dcb007da33c66526d3ae678dc6fdf6a3272fd22a08ccb663ddba15fce3fda6a9f

memory/4148-54-0x00000000056F0000-0x0000000005700000-memory.dmp

memory/4148-55-0x00000000056F0000-0x0000000005700000-memory.dmp