Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:29
Behavioral task
behavioral1
Sample
e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe
Resource
win10v2004-20240226-en
General
-
Target
e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe
-
Size
5.2MB
-
MD5
4b33f2982aa4df81f65b713a7e398b3c
-
SHA1
630b0be15443733a06412b072441ec00075e2f83
-
SHA256
e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84
-
SHA512
7efceddfe0d85ea082650d47e3897dd35b3117154fa20b391f2db8626bcb2a3ba04bb0ae3e7efff9fb5585c4c95262f0669c7aa72ff322a8138cb35d8d841205
-
SSDEEP
98304:Oh9o1ezhQcSZcOb+sX1ZvbeG4Z0FGRABTgtse6vzovknQp:Oh9hhQcERCsXDjfZkJMQp
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:8848
SecurityHealthService.exe
-
reg_key
SecurityHealthService.exe
-
splitter
|Ghost|
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
Processes:
resource yara_rule C:\main.exe INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs
Processes:
resource yara_rule C:\main.exe INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
main.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation main.exe -
Drops startup file 3 IoCs
Processes:
SecurityHealthService.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthService.exe SecurityHealthService.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthService.exe SecurityHealthService.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthService.url SecurityHealthService.exe -
Executes dropped EXE 4 IoCs
Processes:
main.exeSecurityHealthService.exeSecurityHealthService.exeSecurityHealthService.exepid process 3732 main.exe 1764 SecurityHealthService.exe 844 SecurityHealthService.exe 3668 SecurityHealthService.exe -
Loads dropped DLL 4 IoCs
Processes:
e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exepid process 984 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe 984 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe 984 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe 984 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecurityHealthService.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService.exe\" .." SecurityHealthService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService.exe\" .." SecurityHealthService.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3516 schtasks.exe 1564 schtasks.exe 1536 schtasks.exe 3300 schtasks.exe 3604 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
SecurityHealthService.exedescription pid process Token: SeDebugPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe Token: 33 1764 SecurityHealthService.exe Token: SeIncBasePriorityPrivilege 1764 SecurityHealthService.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exee01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.execmd.exemain.exeSecurityHealthService.exedescription pid process target process PID 4436 wrote to memory of 984 4436 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe PID 4436 wrote to memory of 984 4436 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe PID 984 wrote to memory of 2964 984 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe cmd.exe PID 984 wrote to memory of 2964 984 e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe cmd.exe PID 2964 wrote to memory of 3732 2964 cmd.exe main.exe PID 2964 wrote to memory of 3732 2964 cmd.exe main.exe PID 2964 wrote to memory of 3732 2964 cmd.exe main.exe PID 3732 wrote to memory of 1764 3732 main.exe SecurityHealthService.exe PID 3732 wrote to memory of 1764 3732 main.exe SecurityHealthService.exe PID 3732 wrote to memory of 1764 3732 main.exe SecurityHealthService.exe PID 1764 wrote to memory of 4044 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 4044 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 4044 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3604 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3604 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3604 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3872 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3872 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3872 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3516 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3516 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3516 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 4436 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 4436 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 4436 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1564 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1564 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1564 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1012 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1012 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1012 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1536 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1536 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 1536 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 388 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 388 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 388 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3300 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3300 1764 SecurityHealthService.exe schtasks.exe PID 1764 wrote to memory of 3300 1764 SecurityHealthService.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe"C:\Users\Admin\AppData\Local\Temp\e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe"C:\Users\Admin\AppData\Local\Temp\e01df4c5286089fb07206d0c3b7c245b5321a88fb9e19e413ca431608a0e7e84.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\\main.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\main.exeC:\\main.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe"C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "SecurityHealthService" /f6⤵PID:4044
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe6⤵
- Creates scheduled task(s)
PID:3604 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "SecurityHealthService" /f6⤵PID:3872
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe6⤵
- Creates scheduled task(s)
PID:3516 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "SecurityHealthService" /f6⤵PID:4436
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe6⤵
- Creates scheduled task(s)
PID:1564 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "SecurityHealthService" /f6⤵PID:1012
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe6⤵
- Creates scheduled task(s)
PID:1536 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "SecurityHealthService" /f6⤵PID:388
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "SecurityHealthService" /tr C:\Users\Admin\AppData\Roaming\SecurityHealthService.exe6⤵
- Creates scheduled task(s)
PID:3300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1712 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:1956
-
C:\Users\Admin\AppData\Roaming\SecurityHealthService.exeC:\Users\Admin\AppData\Roaming\SecurityHealthService.exe1⤵
- Executes dropped EXE
PID:844
-
C:\Users\Admin\AppData\Roaming\SecurityHealthService.exeC:\Users\Admin\AppData\Roaming\SecurityHealthService.exe1⤵
- Executes dropped EXE
PID:3668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SecurityHealthService.exe.logFilesize
319B
MD5da4fafeffe21b7cb3a8c170ca7911976
SHA150ef77e2451ab60f93f4db88325b897d215be5ad
SHA2567341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
SHA5120bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\VCRUNTIME140.dllFilesize
93KB
MD54a365ffdbde27954e768358f4a4ce82e
SHA1a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA2566a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA51254e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\_bz2.pydFilesize
84KB
MD5e91b4f8e1592da26bacaceb542a220a8
SHA15459d4c2147fa6db75211c3ec6166b869738bd38
SHA25620895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
SHA512cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\_decimal.pydFilesize
264KB
MD565287fd87a64bc756867a1afddec9e29
SHA1cda1db353f81df7a4a818add8f87bca9ac840455
SHA256df19c2e6ec3145166fa8d206c11db78bc1979a027105c4f21d40410b5082ba34
SHA5123e3f19cf965b260ffc68e45d5101234e8a957411c076a0d487d307dcfa714a9801cb501224fe7621937aebdf90275f655c8a70dd6675bcfb5374404fda53236f
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\_hashlib.pydFilesize
64KB
MD57c69cb3cb3182a97e3e9a30d2241ebed
SHA11b8754ff57a14c32bcadc330d4880382c7fffc93
SHA25612a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
SHA51296dbabbc6b98d473cbe06dcd296f6c6004c485e57ac5ba10560a377393875192b22df8a7103fe4a22795b8d81b8b0ae14ce7646262f87cb609b9e2590a93169e
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\_lzma.pydFilesize
159KB
MD5493c33ddf375b394b648c4283b326481
SHA159c87ee582ba550f064429cb26ad79622c594f08
SHA2566384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
SHA512a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\_socket.pydFilesize
78KB
MD5fd1cfe0f0023c5780247f11d8d2802c9
SHA15b29a3b4c6edb6fa176077e1f1432e3b0178f2bc
SHA256258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
SHA512b304a2e56829a557ec401c6fdda78d6d05b7495a610c1ed793d6b25fc5af891cb2a1581addb27ab5e2a6cb0be24d9678f67b97828015161bc875df9b7b5055ae
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\base_library.zipFilesize
826KB
MD52abe470164e060916c6842da1263e5ad
SHA1197163bfb26ce54420fa6eba03cf0fa0a5622934
SHA256151a4c8ea261130b5ae94653e5470ac6fe4663de269c187b2b38d6fccadc1baa
SHA51201e2c58b24f7d3d7b31df97c6dbe8aee0c0f61f457c78d62830fa954c17dffb74b4e5389ef389926b5ba78f96deb08ad4cd61c9ecea256bf35e0a99cd2366d65
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\libcrypto-1_1.dllFilesize
3.2MB
MD589511df61678befa2f62f5025c8c8448
SHA1df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA5129af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\main.zipFilesize
65KB
MD5e87566acf4ca1c9983971705a6c60906
SHA1895740f5e3a9e70f720092946fc1e883466a26bc
SHA25652507bc59bce399e5db789241fcc171a2ca5c868a8c2c985d3e02364af1a4990
SHA5120bcd79fcdfc1490f8f5078bc12bd6c11ff7d66c875c95523a64fd8df63deb94f83046247ff2823f25eac7b70920180cac50a90130bc03470249595dbf97284d4
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\python39.dllFilesize
4.3MB
MD55cd203d356a77646856341a0c9135fc6
SHA1a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA256a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
SHA512390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\select.pydFilesize
28KB
MD50e3cf5d792a3f543be8bbc186b97a27a
SHA150f4c70fce31504c6b746a2c8d9754a16ebc8d5e
SHA256c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
SHA512224b42e05b4dbdf7275ee7c5d3eb190024fc55e22e38bd189c1685efee2a3dd527c6dfcb2feeec525b8d6dc35aded1eac2423ed62bb2599bb6a9ea34e842c340
-
C:\Users\Admin\AppData\Local\Temp\_MEI44362\unicodedata.pydFilesize
1.1MB
MD57af51031368619638cca688a7275db14
SHA164e2cc5ac5afe8a65af690047dc03858157e964c
SHA2567f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
SHA512fbde24501288ff9b06fc96faff5e7a1849765df239e816774c04a4a6ef54a0c641adf4325bfb116952082d3234baef12288174ad8c18b62407109f29aa5ab326
-
C:\main.exeFilesize
65KB
MD5fef0fb51e5e35ca9244420c7675bb346
SHA1ed4284dc3642bf59f8301b68b48fbb03ad5387f3
SHA25621f539d71ad30ea865ccf0ee4dfdf6322b4895ce2cf8af67f120c2dfc84af33b
SHA51266ec13dedfad899f29a5676ae6cb06d5eb357a8b31806154d91764069f748f1f4f5eb479211029bc72f0ee7b1dc3628ba5a8bb0a7e376d37bd4d94c18fb0f043
-
memory/1764-45-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/1764-46-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/1764-47-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/1764-53-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/3732-33-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/3732-34-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/3732-43-0x0000000074FB2000-0x0000000074FB3000-memory.dmpFilesize
4KB
-
memory/3732-44-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/3732-49-0x0000000074FB0000-0x0000000075561000-memory.dmpFilesize
5.7MB
-
memory/3732-32-0x0000000074FB2000-0x0000000074FB3000-memory.dmpFilesize
4KB