Analysis
-
max time kernel
98s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:30
Static task
static1
Behavioral task
behavioral1
Sample
974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe
Resource
win10v2004-20220414-en
General
-
Target
974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe
-
Size
216KB
-
MD5
3b23e12bff983d52dbca22c700e9338a
-
SHA1
52dcde5bc8934ab70b76a21f6a559626129834c6
-
SHA256
974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19
-
SHA512
991fd833b1a3363680fa35cf709c39a9bce426d6e6e0d0453b7fe263a5b0f2174f9eacdc8e03d468c6001e2b25f4eb1a27b391fcb05ad0237d6cab6397740426
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
Processes:
mtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exemtldrinst.exepid process 4484 mtldrinst.exe 524 mtldrinst.exe 1420 mtldrinst.exe 4208 mtldrinst.exe 2324 mtldrinst.exe 2704 mtldrinst.exe 3560 mtldrinst.exe 4680 mtldrinst.exe 2940 mtldrinst.exe 3908 mtldrinst.exe 4476 mtldrinst.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
mtldrinst.exedescription ioc process File opened for modification \??\PhysicalDrive0 mtldrinst.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exepid process 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3900 wrote to memory of 408 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 408 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 408 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 408 wrote to memory of 4484 408 cmd.exe mtldrinst.exe PID 408 wrote to memory of 4484 408 cmd.exe mtldrinst.exe PID 408 wrote to memory of 4484 408 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 4912 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4912 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4912 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 4912 wrote to memory of 524 4912 cmd.exe mtldrinst.exe PID 4912 wrote to memory of 524 4912 cmd.exe mtldrinst.exe PID 4912 wrote to memory of 524 4912 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 760 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 760 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 760 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 760 wrote to memory of 1420 760 cmd.exe mtldrinst.exe PID 760 wrote to memory of 1420 760 cmd.exe mtldrinst.exe PID 760 wrote to memory of 1420 760 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 2876 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 2876 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 2876 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 2876 wrote to memory of 4208 2876 cmd.exe mtldrinst.exe PID 2876 wrote to memory of 4208 2876 cmd.exe mtldrinst.exe PID 2876 wrote to memory of 4208 2876 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 608 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 608 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 608 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 608 wrote to memory of 2324 608 cmd.exe mtldrinst.exe PID 608 wrote to memory of 2324 608 cmd.exe mtldrinst.exe PID 608 wrote to memory of 2324 608 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 1680 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 1680 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 1680 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 1680 wrote to memory of 2704 1680 cmd.exe mtldrinst.exe PID 1680 wrote to memory of 2704 1680 cmd.exe mtldrinst.exe PID 1680 wrote to memory of 2704 1680 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 2696 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 2696 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 2696 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 2696 wrote to memory of 3560 2696 cmd.exe mtldrinst.exe PID 2696 wrote to memory of 3560 2696 cmd.exe mtldrinst.exe PID 2696 wrote to memory of 3560 2696 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 4044 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4044 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4044 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 4044 wrote to memory of 4680 4044 cmd.exe mtldrinst.exe PID 4044 wrote to memory of 4680 4044 cmd.exe mtldrinst.exe PID 4044 wrote to memory of 4680 4044 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 4948 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4948 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4948 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 4948 wrote to memory of 2940 4948 cmd.exe mtldrinst.exe PID 4948 wrote to memory of 2940 4948 cmd.exe mtldrinst.exe PID 4948 wrote to memory of 2940 4948 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 4944 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4944 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4944 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 4944 wrote to memory of 3908 4944 cmd.exe mtldrinst.exe PID 4944 wrote to memory of 3908 4944 cmd.exe mtldrinst.exe PID 4944 wrote to memory of 3908 4944 cmd.exe mtldrinst.exe PID 3900 wrote to memory of 4624 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4624 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 3900 wrote to memory of 4624 3900 974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe cmd.exe PID 4624 wrote to memory of 4476 4624 cmd.exe mtldrinst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe"C:\Users\Admin\AppData\Local\Temp\974a20e3681cbedd1674c4fadacf1481e6e7f1985f69589caf37313464fa1a19.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd0) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd0)3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd1) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd1)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd2) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd2)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd3) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd3)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd4) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd4)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd5) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd5)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd6) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd6)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd7) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd7)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd8) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd8)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd9) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd9)3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd10) > C:\Users\Admin\AppData\Local\Temp\tempch.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeC:\Users\Admin\AppData\Local\Temp\mtldrinst.EXE -l (hd10)3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\mtldrinst.exeFilesize
45KB
MD5a1d33b80e8d5b80ed549811fd3070018
SHA11967be963184532df6af0a126d26c6a9798a4ad6
SHA256fbc13115ccac312a521570df7818518ec3cc1c7f6d17dd98a44f17c96236c219
SHA512d9c9c6172d0804617abadab4bd3b50839baef013f8536b38d292345d9f07526d79ac7311a2b9c15a44fbb220b31282f857b97a1988e79f5878f9deeded322514
-
C:\Users\Admin\AppData\Local\Temp\tempch.tmpFilesize
96B
MD5107fcbd4d9c40561fe52e5f95fc99c61
SHA1180e0fde39d11d683ee621838a1b5275dcb6a743
SHA256c669aa6bd63c5772beabf37cf45f0e24de34df0474f39a8aabaee616165d45ce
SHA5123f4a0c5d1fc162718a2f5dc7fb1aefa0fd040cdd9c079bc9f367aa2f19367229e843fe75a9e1984f27c7b746ec396bc1f1348074458e5e5923afc82f54b8994e
-
memory/408-132-0x0000000000000000-mapping.dmp
-
memory/524-138-0x0000000000000000-mapping.dmp
-
memory/608-146-0x0000000000000000-mapping.dmp
-
memory/760-140-0x0000000000000000-mapping.dmp
-
memory/1420-141-0x0000000000000000-mapping.dmp
-
memory/1680-149-0x0000000000000000-mapping.dmp
-
memory/2324-147-0x0000000000000000-mapping.dmp
-
memory/2696-152-0x0000000000000000-mapping.dmp
-
memory/2704-150-0x0000000000000000-mapping.dmp
-
memory/2876-143-0x0000000000000000-mapping.dmp
-
memory/2940-159-0x0000000000000000-mapping.dmp
-
memory/3560-153-0x0000000000000000-mapping.dmp
-
memory/3908-162-0x0000000000000000-mapping.dmp
-
memory/4044-155-0x0000000000000000-mapping.dmp
-
memory/4208-144-0x0000000000000000-mapping.dmp
-
memory/4476-165-0x0000000000000000-mapping.dmp
-
memory/4484-133-0x0000000000000000-mapping.dmp
-
memory/4624-164-0x0000000000000000-mapping.dmp
-
memory/4680-156-0x0000000000000000-mapping.dmp
-
memory/4912-137-0x0000000000000000-mapping.dmp
-
memory/4944-161-0x0000000000000000-mapping.dmp
-
memory/4948-158-0x0000000000000000-mapping.dmp