latentbot | dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe
Size 382KB
Sample240410-rtegsabb37
SHA256 dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461
MD5 61c22386df656f32f45bc1928a1e5a94
SHA1 3f448c01907cf6dc39c3cdd4860accf5f222aff6
SHA512 14e32e6b8e14b8c128515dda07d50c2b2da2a50ff60fff6b9a29d04000100b45e9fa79689ba2da36de7082257963005d33332ff30dbb121631eb405031de4c41
SSDEEP 6144:Bz+92mhAMJ/cPl3i8/hwJBXvJ+AiSWnmRR/Iq1ipEH3fa9t7SroeR43ddDWQt1S2:BK2mhAMJ/cPlJiXv4Aivmr/opq3S9g8H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot netwire botnet persistence rat stealer trojan upx

Malware Config

Extracted

Family

netwire

atlaswebportal.zapto.org:4000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
1.6_R1_26.12.15
keylogger_dir
C:\NVIDIA\profile\
lock_executable
false
offline_keylogger
true
password
Micr0s0ft4456877
registry_autorun
false
use_mutex
false

Extracted

Family

latentbot

atlaswebportal.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2848-69-0x0000000000400000-0x0000000000421000-memory.dmp	netwire
behavioral2/memory/2848-75-0x0000000000400000-0x0000000000421000-memory.dmp	netwire
behavioral2/memory/2848-132-0x0000000000400000-0x0000000000421000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1048	calc.exe
2848	calc.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023201-52.dat	upx
behavioral2/memory/1048-54-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2848-60-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2848-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1048-70-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/2848-69-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2848-75-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2848-132-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dashlanei = "C:\\NVIDIA\\calc.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1252	PING.EXE
4904	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4956	WINWORD.EXE
4956	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1048	calc.exe
1048	calc.exe
1048	calc.exe
1048	calc.exe
1048	calc.exe
1048	calc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4956	WINWORD.EXE
4956	WINWORD.EXE
4956	WINWORD.EXE
4956	WINWORD.EXE
4956	WINWORD.EXE
4956	WINWORD.EXE
4956	WINWORD.EXE
4956	WINWORD.EXE
1048	calc.exe
1048	calc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4976	3068	dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe	89
PID 3068 wrote to memory of 4976	3068	dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe	89
PID 3068 wrote to memory of 4976	3068	dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe	89
PID 4976 wrote to memory of 1256	4976	WScript.exe	90
PID 4976 wrote to memory of 1256	4976	WScript.exe	90
PID 4976 wrote to memory of 1256	4976	WScript.exe	90
PID 1256 wrote to memory of 4956	1256	cmd.exe	92
PID 1256 wrote to memory of 4956	1256	cmd.exe	92
PID 1256 wrote to memory of 1252	1256	cmd.exe	94
PID 1256 wrote to memory of 1252	1256	cmd.exe	94
PID 1256 wrote to memory of 1252	1256	cmd.exe	94
PID 1256 wrote to memory of 1048	1256	cmd.exe	101
PID 1256 wrote to memory of 1048	1256	cmd.exe	101
PID 1256 wrote to memory of 1048	1256	cmd.exe	101
PID 1256 wrote to memory of 4904	1256	cmd.exe	102
PID 1256 wrote to memory of 4904	1256	cmd.exe	102
PID 1256 wrote to memory of 4904	1256	cmd.exe	102
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103
PID 1048 wrote to memory of 2848	1048	calc.exe	103

C:\Users\Admin\AppData\Local\Temp\dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe
"C:\Users\Admin\AppData\Local\Temp\dbfa0bedf01e570f988beb7562f97356a9dc6cd97dc9908b99e99eb732f80461.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\NVIDIA\basic.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c list
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\NVIDIA\note.docx" /o ""
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:4956
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:1252
  - - C:\NVIDIA\calc.exe
      calc
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\NVIDIA\calc.exe
        
        calc
        5⤵
        Executes dropped EXE
        
        PID:2848
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      Runs ping.exe
      PID:4904
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Dashlanei" /t REG_SZ /F /D "C:\NVIDIA\calc.exe"
      4⤵
      Adds Run key to start application
      PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

basic.vbs

Path C:\NVIDIA\basic.vbs
Size 75B
SHA256 464197b90d24c3faf5cc5b693ee56ffb2be966128333ea3a6e1d3371d5d80cf8
MD5 52fb3785e14372eb6fff108e76fae8e7
SHA1 98ace9a7aa04cb0b541aa4e49a123d963aef75b9
SHA512 9d53d11f0b8f7761f5af29c00c2c9593ed6a725aed24446d2f642900f04fb92e54eb203afb34b210f2665db7f663df506aabe46dd780aafbf5f1d804d6c203c6
MD5 SHA1 SHA512

Submit Download

calc.exe

Path C:\NVIDIA\calc.exe
Size 138KB
SHA256 b1348340f4f090946d5ffc1a0ff203ce9770d95aa3725019e58b2648c4eef21f
MD5 6be54d26001bd55770e3259562046ab2
SHA1 8bbf5e6a646d077eba233adbc130b6ef132a6eac
SHA512 a86aaf88e6e2c5c8ba7844714a997c03a4aa1c95eabf12276e6342080e3db385a6c04dcf96ca9a2998550b98dea25e293082e6db3408d920f769820a35f4ef4c
SSDEEP 3072:Gmya12fDaJb/q7xCo0GVil+RefgcZgVcJ7iyVcoutPa:GC2aJby7xCIisRHQgVq7SoSPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

list.bat

Path C:\NVIDIA\list.bat
Size 195B
SHA256 f9332ad2cd968d0a9748ee4db185a7630aa80feabde5ef7c6e1274f8d57d17e6
MD5 4b59f222334f6a4161de6028666c79c3
SHA1 7ab1dee8237083e164729dff6ef369c320dd0bec
SHA512 8206fe23ae1faf5100a53bfde913ed35d5ebb36b4952acc77832079cef04673585b0a098767e32d329c39981866fb36bfbf9446ac2c02a58615b5295f1bd35a4
MD5 SHA1 SHA512

Submit Download

note.docx

Path C:\NVIDIA\note.docx
Size 154KB
SHA256 d6f75dddbc531405dbe129bc44932e63adcc32288804131f3db7fc6132ae97e5
MD5 0b7b2868e9523f125205d395ab6a92c2
SHA1 e7d0df5b7fac6b229fc22a229b418ba37c395dff
SHA512 f0415c4e99553d229d5edd483134db8cc8168d62baaa167a009c37ce85eb7ed4c9060a60cc6f5cc3f14605baa0d4bccb84ba337d49a0a396c74ae1499ba7cc20
SSDEEP 3072:1gYvHFrGD7fT3p6URr+O2zE9EDMeDFCV5mB7dSsH5iTIFP/0Cw:icxeMUx+TzOEDMexCmB7dSsH3MCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

8C905E72.jpeg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8C905E72.jpeg
Size 707B
SHA256 cc0f5f4a2f3e05a34b81d767646cc885c8435d4bb3e7046638432f1ee1cf5f98
MD5 9dce5b2d0261b8e29f18e79560b98a43
SHA1 6c13122fb1f2d66c92724ac7262f28e4b157f60e
SHA512 459be63faff4b149f114159763235999d4a14c890b1e296ee025685804347449be0af75a07e0b0ec68f2c1c5f735d069e0765e65747afb829d87bbbba7deda12
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 217B
SHA256 2d8c1745676873fdd91394e5555d215dfaebb53aaaabceb54a19d8646a6e6657
MD5 2ef3e45963d8d7b6cf1a9f591184f4be
SHA1 1ade9c460186edddb067451623563b60c1ce0b3f
SHA512 2ff70491c2181962dc66d3ce6f88da60583cc3b0c5cce7ebb6846e02b1d536cec4af8d3416ef9eb51ff0749ae919ec6293deb8188741f663711a888449420c3c
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 00d2f57ab2e9622a1b3bf1a0f0707198afab488a945ef8d1d2766fe9c6f60a54
MD5 2fabe7e436703478a3cba254b2d1ac3f
SHA1 b6dc7dc3ecb2851bcc6335458e22818bb203c66f
SHA512 5447a9fb9472411f483bc57a37f51d70418c4b542420f8383290e73d36a77994eb6bc3a2a60403e61af02e9b1807b305a6048a47e55c30ac4cbb12d2a669a9be
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 d48e233891d721bd3756f748f2303279205caebe79a0f982cad73b16bb91fd8a
MD5 56847311015895935492b8d4a48500b6
SHA1 247241754b839dd2b91b66f1d73c84aaab80443d
SHA512 e46ef185f605416f4b2fa670635f4bcd17e1d37cdf8fff5d1b02bde31bc00630b36d301d9ae0e172cd57c702aeeb6bcf834be6dc6f7bdd9854cea61c051de5b2
MD5 SHA1 SHA512

Submit Download

memory/1048-72-0x0000000002220000-0x000000000229B000-memory.dmp

Download

memory/1048-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1048-58-0x0000000002220000-0x000000000229B000-memory.dmp

Download

memory/1048-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2848-60-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2848-62-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2848-144-0x0000000076000000-0x00000000760F0000-memory.dmp

Download

memory/2848-132-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2848-77-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/2848-76-0x0000000076000000-0x00000000760F0000-memory.dmp

Download

memory/2848-75-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2848-71-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/2848-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4956-20-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-112-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-19-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-21-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-22-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-23-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-18-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-24-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-28-0x00007FFCAB770000-0x00007FFCAB780000-memory.dmp

Download

memory/4956-16-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-17-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-14-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-15-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-25-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-116-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-27-0x00007FFCAB770000-0x00007FFCAB780000-memory.dmp

Download

memory/4956-133-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-26-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-176-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-177-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-179-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download

memory/4956-182-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-181-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-180-0x00007FFCED870000-0x00007FFCEDA65000-memory.dmp

Download

memory/4956-178-0x00007FFCAD8F0000-0x00007FFCAD900000-memory.dmp

Download