Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:43
Behavioral task
behavioral1
Sample
d2bc5be85fa4fe738bb81bd513e68a4afdae6ecf97d4581acc679beb9d988a1c.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
d2bc5be85fa4fe738bb81bd513e68a4afdae6ecf97d4581acc679beb9d988a1c.exe
Resource
win10v20201028
General
-
Target
d2bc5be85fa4fe738bb81bd513e68a4afdae6ecf97d4581acc679beb9d988a1c.exe
-
Size
642KB
-
MD5
cc2b4d3ef7aada14aa05e9005e3878d6
-
SHA1
5275469a3c55e93e5d673e142d3530dbd0290ee0
-
SHA256
d2bc5be85fa4fe738bb81bd513e68a4afdae6ecf97d4581acc679beb9d988a1c
-
SHA512
a6545b371f42c3a9545f633a7b66805aea768f4e87ce2ff70b493827401f47f7d0acdf4598fc8bed196d06e0a6a136d683e8bac1dce2127fa1b3e09392177eeb
Malware Config
Signatures
-
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08370F71-23B0-11EB-963B-EE4CB9E4853B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19AD65B1-23B0-11EB-963B-EE4CB9E4853B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 1384 iexplore.exe 1532 iexplore.exe 876 iexplore.exe 760 iexplore.exe 908 iexplore.exe 952 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 1384 iexplore.exe 1384 iexplore.exe 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1532 iexplore.exe 1532 iexplore.exe 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 876 iexplore.exe 876 iexplore.exe 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 760 iexplore.exe 760 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 908 iexplore.exe 908 iexplore.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 952 iexplore.exe 952 iexplore.exe 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 1384 wrote to memory of 1056 1384 iexplore.exe IEXPLORE.EXE PID 1384 wrote to memory of 1056 1384 iexplore.exe IEXPLORE.EXE PID 1384 wrote to memory of 1056 1384 iexplore.exe IEXPLORE.EXE PID 1384 wrote to memory of 1056 1384 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1920 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1920 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1920 1532 iexplore.exe IEXPLORE.EXE PID 1532 wrote to memory of 1920 1532 iexplore.exe IEXPLORE.EXE PID 876 wrote to memory of 1512 876 iexplore.exe IEXPLORE.EXE PID 876 wrote to memory of 1512 876 iexplore.exe IEXPLORE.EXE PID 876 wrote to memory of 1512 876 iexplore.exe IEXPLORE.EXE PID 876 wrote to memory of 1512 876 iexplore.exe IEXPLORE.EXE PID 760 wrote to memory of 1620 760 iexplore.exe IEXPLORE.EXE PID 760 wrote to memory of 1620 760 iexplore.exe IEXPLORE.EXE PID 760 wrote to memory of 1620 760 iexplore.exe IEXPLORE.EXE PID 760 wrote to memory of 1620 760 iexplore.exe IEXPLORE.EXE PID 908 wrote to memory of 1448 908 iexplore.exe IEXPLORE.EXE PID 908 wrote to memory of 1448 908 iexplore.exe IEXPLORE.EXE PID 908 wrote to memory of 1448 908 iexplore.exe IEXPLORE.EXE PID 908 wrote to memory of 1448 908 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1180 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1180 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1180 952 iexplore.exe IEXPLORE.EXE PID 952 wrote to memory of 1180 952 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2bc5be85fa4fe738bb81bd513e68a4afdae6ecf97d4581acc679beb9d988a1c.exe"C:\Users\Admin\AppData\Local\Temp\d2bc5be85fa4fe738bb81bd513e68a4afdae6ecf97d4581acc679beb9d988a1c.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.datMD5
03538e6996fdfcbdfe9a61726c3b994a
SHA1d8e8f27a7e1ec9fb002c5b1383dd3fd0bfdd5066
SHA25619d0e656867f1c2fcc9949c3238632a315d028f9fcdcf15479f65eb3ba0a4ce1
SHA5121016d21f1b2f963b75141ca67193ec2dd7b8be50aee8c405da050a8af9f84408b8e275d1e3cc0a33cef383147cca4ff8314d2a0a105358d90fe5a0dad3a9be5b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.datMD5
03538e6996fdfcbdfe9a61726c3b994a
SHA1d8e8f27a7e1ec9fb002c5b1383dd3fd0bfdd5066
SHA25619d0e656867f1c2fcc9949c3238632a315d028f9fcdcf15479f65eb3ba0a4ce1
SHA5121016d21f1b2f963b75141ca67193ec2dd7b8be50aee8c405da050a8af9f84408b8e275d1e3cc0a33cef383147cca4ff8314d2a0a105358d90fe5a0dad3a9be5b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.datMD5
03538e6996fdfcbdfe9a61726c3b994a
SHA1d8e8f27a7e1ec9fb002c5b1383dd3fd0bfdd5066
SHA25619d0e656867f1c2fcc9949c3238632a315d028f9fcdcf15479f65eb3ba0a4ce1
SHA5121016d21f1b2f963b75141ca67193ec2dd7b8be50aee8c405da050a8af9f84408b8e275d1e3cc0a33cef383147cca4ff8314d2a0a105358d90fe5a0dad3a9be5b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.datMD5
03538e6996fdfcbdfe9a61726c3b994a
SHA1d8e8f27a7e1ec9fb002c5b1383dd3fd0bfdd5066
SHA25619d0e656867f1c2fcc9949c3238632a315d028f9fcdcf15479f65eb3ba0a4ce1
SHA5121016d21f1b2f963b75141ca67193ec2dd7b8be50aee8c405da050a8af9f84408b8e275d1e3cc0a33cef383147cca4ff8314d2a0a105358d90fe5a0dad3a9be5b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.datMD5
03538e6996fdfcbdfe9a61726c3b994a
SHA1d8e8f27a7e1ec9fb002c5b1383dd3fd0bfdd5066
SHA25619d0e656867f1c2fcc9949c3238632a315d028f9fcdcf15479f65eb3ba0a4ce1
SHA5121016d21f1b2f963b75141ca67193ec2dd7b8be50aee8c405da050a8af9f84408b8e275d1e3cc0a33cef383147cca4ff8314d2a0a105358d90fe5a0dad3a9be5b
-
memory/292-1-0x000007FEF7590000-0x000007FEF780A000-memory.dmpFilesize
2.5MB
-
memory/344-0-0x00000000002A0000-0x00000000002B6000-memory.dmpFilesize
88KB
-
memory/1056-3-0x0000000005BA0000-0x0000000005BC3000-memory.dmpFilesize
140KB
-
memory/1056-2-0x0000000000000000-mapping.dmp
-
memory/1180-12-0x0000000000000000-mapping.dmp
-
memory/1448-10-0x0000000000000000-mapping.dmp
-
memory/1512-6-0x0000000000000000-mapping.dmp
-
memory/1620-8-0x0000000000000000-mapping.dmp
-
memory/1920-4-0x0000000000000000-mapping.dmp