Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 13:05
Behavioral task
behavioral1
Sample
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe
-
Size
160KB
-
MD5
9251dd806a703d4a6b388e504e5020f3
-
SHA1
a9c78679a7effe14bac6b0fe440af504c50d7d1f
-
SHA256
83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68
-
SHA512
f67f5f44ef17128b575608c4a8eddd76af172ebee276c752cb7a6e149cc244e0df81166bab52435f3a1db26b42f2d141e1aa338366a81a616792a0a07b110862
-
SSDEEP
3072:kDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP33682wa9h+f2s9L6AsW:m5d/zugZqll3a5OB9L6
Malware Config
Extracted
C:\Users\NOokKHoMb.README.txt
http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/
http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/
http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
https://twitter.com/hashtag/lockbit?f=live
http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion
http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion
http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion
http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion
http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion
Signatures
-
Renames multiple (171) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
67B3.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 67B3.tmp -
Deletes itself 1 IoCs
Processes:
67B3.tmppid process 4244 67B3.tmp -
Executes dropped EXE 1 IoCs
Processes:
67B3.tmppid process 4244 67B3.tmp -
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\NOokKHoMb.bmp" 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\NOokKHoMb.bmp" 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe67B3.tmppid process 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NOokKHoMb\DefaultIcon\ = "C:\\ProgramData\\NOokKHoMb.ico" 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.NOokKHoMb 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.NOokKHoMb\ = "NOokKHoMb" 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NOokKHoMb\DefaultIcon 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NOokKHoMb 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exepid process 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
67B3.tmppid process 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp 4244 67B3.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exevssvc.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeDebugPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: 36 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeImpersonatePrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeIncBasePriorityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeIncreaseQuotaPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: 33 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeManageVolumePrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeProfSingleProcessPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeRestorePrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSystemProfilePrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeTakeOwnershipPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeShutdownPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeDebugPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 1720 vssvc.exe Token: SeRestorePrivilege 1720 vssvc.exe Token: SeAuditPrivilege 1720 vssvc.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeSecurityPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe Token: SeBackupPrivilege 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe67B3.tmpdescription pid process target process PID 3360 wrote to memory of 4244 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 67B3.tmp PID 3360 wrote to memory of 4244 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 67B3.tmp PID 3360 wrote to memory of 4244 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 67B3.tmp PID 3360 wrote to memory of 4244 3360 2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe 67B3.tmp PID 4244 wrote to memory of 3696 4244 67B3.tmp cmd.exe PID 4244 wrote to memory of 3696 4244 67B3.tmp cmd.exe PID 4244 wrote to memory of 3696 4244 67B3.tmp cmd.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_9251dd806a703d4a6b388e504e5020f3_darkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\67B3.tmp"C:\ProgramData\67B3.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\67B3.tmp >> NUL3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.iniFilesize
129B
MD5da0542582534b80ba989bc50b3cb9b32
SHA16fbec65a61dd07b5afa303db4e97f0d49fad2801
SHA2567da54e30703199cb016e0c1f8802be60a509dc5573375b828f3d0972b01f8798
SHA5125e0f22e0eb0f59191f7331cecfc6ca18626ecfe1637795ed2525f6e7ce77c557ced72af34a0ca4a0b6aedaee065efc8efead9a7bf19b4bd2ecf2aa9249a74199
-
C:\ProgramData\67B3.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDFilesize
160KB
MD5cb881ff293e7f96cd51bd26a0f565e08
SHA1e0d5843a305bf9da03d8469dbc7fe2ab35c1a49f
SHA2564bfe372aae85214944f1faf7aff71c83e524ed02e2c018df53f92d89af66e07a
SHA512bc7aff3dbe45281208832d20088ebfb2e27aebc3d57a73f748b68a65203a6dba7f238d021da6a572878550d5e3e0d5a8a299a8524730f67618ae3b2ca2ecb124
-
C:\Users\NOokKHoMb.README.txtFilesize
3KB
MD535349283e1b1847b855116c0fdd1a757
SHA1666f5178ffa4a90c0a6572d71f0d401154a6fe43
SHA256add21558b78a9ecb20f4703ae4a215ff67ea68ab5786030d9b88a4c28d2b9f8b
SHA512d1a20ffb95f8746f754676fcb6715d3be4e132ece82d162ba4b474fc822d6ffd716bc2e0b8179e3e683e1225e9fb3b713a4199bbec802827341cd3abbb7c84ef
-
F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\DDDDDDDDDDDFilesize
129B
MD52ec2b3f9a6574f06d083fe56798a7fa2
SHA1425e84be054c1bfbc0b06ba5fc6b0ce849aca923
SHA256a803d2da36d92b06da4d55fed3e1d897015f746a3214e8a53e659d1305442185
SHA5122c414fdca246d1ef60aa68aaf71909c510185aa810e57a0cdecc98db4b86f7211591c1cf8ab1a996d2d9906504a692358f2f56e198f45db021095642d2561290
-
memory/3360-0-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/3360-1-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/3360-2-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/4244-330-0x000000007FDC0000-0x000000007FDC1000-memory.dmpFilesize
4KB
-
memory/4244-329-0x000000007FE20000-0x000000007FE21000-memory.dmpFilesize
4KB
-
memory/4244-328-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/4244-327-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/4244-326-0x000000007FE40000-0x000000007FE41000-memory.dmpFilesize
4KB
-
memory/4244-359-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/4244-360-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/4244-364-0x000000007FE00000-0x000000007FE01000-memory.dmpFilesize
4KB
-
memory/4244-363-0x000000007FDE0000-0x000000007FDE1000-memory.dmpFilesize
4KB