Analysis
-
max time kernel
88s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 00:45
Behavioral task
behavioral1
Sample
Acunetix Premium Activation Tool.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Acunetix Premium Activation Tool.exe
Resource
win10v2004-20220718-en
General
-
Target
Acunetix Premium Activation Tool.exe
-
Size
6.2MB
-
MD5
0537e883d76c11df03adfe93ae6d5500
-
SHA1
f3090d8e68e8c35ed7e35a862759e3f444f0320c
-
SHA256
24354524397121389a297ac8a7c1af8b7d3fd9f9caf6f21975557b6d0e531091
-
SHA512
1f44e1acb1a1b66ca988f8233f10fc531c1f71303856ac9e442cc7f950894b8da37e40a89c99bd8cf1f27a85148033ef8bc1068060d6e5a052e60e64010f8380
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Acunetix Premium Activation Tool.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Acunetix Premium Activation Tool.exe -
Drops file in Drivers directory 2 IoCs
Processes:
Acunetix Premium Activation Tool.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts Acunetix Premium Activation Tool.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Acunetix Premium Activation Tool.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Acunetix Premium Activation Tool.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Acunetix Premium Activation Tool.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Acunetix Premium Activation Tool.exe -
Processes:
resource yara_rule behavioral2/memory/620-130-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-132-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-133-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-134-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-135-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-136-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-137-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-138-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-139-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-140-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida behavioral2/memory/620-151-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1178428168-2939480073-3055857545-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Acunetix Premium Activation Tool.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Acunetix Premium Activation Tool.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/620-133-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-134-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-135-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-136-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-137-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-138-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-139-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-140-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe behavioral2/memory/620-151-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Acunetix Premium Activation Tool.exepid process 620 Acunetix Premium Activation Tool.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Acunetix Premium Activation Tool.exemsedge.exemsedge.exepid process 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 1580 msedge.exe 1580 msedge.exe 4408 msedge.exe 4408 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Acunetix Premium Activation Tool.exepid process 620 Acunetix Premium Activation Tool.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 4408 msedge.exe 4408 msedge.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
Processes:
Acunetix Premium Activation Tool.exemsedge.exepid process 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 4408 msedge.exe 4408 msedge.exe 4408 msedge.exe 4408 msedge.exe -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
Acunetix Premium Activation Tool.exepid process 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe 620 Acunetix Premium Activation Tool.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Acunetix Premium Activation Tool.execmd.exenet.execmd.exenet.execmd.exemsedge.exedescription pid process target process PID 620 wrote to memory of 1116 620 Acunetix Premium Activation Tool.exe cmd.exe PID 620 wrote to memory of 1116 620 Acunetix Premium Activation Tool.exe cmd.exe PID 1116 wrote to memory of 4460 1116 cmd.exe net.exe PID 1116 wrote to memory of 4460 1116 cmd.exe net.exe PID 4460 wrote to memory of 448 4460 net.exe net1.exe PID 4460 wrote to memory of 448 4460 net.exe net1.exe PID 620 wrote to memory of 4168 620 Acunetix Premium Activation Tool.exe cmd.exe PID 620 wrote to memory of 4168 620 Acunetix Premium Activation Tool.exe cmd.exe PID 4168 wrote to memory of 4992 4168 cmd.exe net.exe PID 4168 wrote to memory of 4992 4168 cmd.exe net.exe PID 4992 wrote to memory of 1828 4992 net.exe net1.exe PID 4992 wrote to memory of 1828 4992 net.exe net1.exe PID 620 wrote to memory of 4436 620 Acunetix Premium Activation Tool.exe cmd.exe PID 620 wrote to memory of 4436 620 Acunetix Premium Activation Tool.exe cmd.exe PID 4436 wrote to memory of 4408 4436 cmd.exe msedge.exe PID 4436 wrote to memory of 4408 4436 cmd.exe msedge.exe PID 4408 wrote to memory of 5112 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 5112 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4596 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 1580 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 1580 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4888 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4888 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4888 4408 msedge.exe msedge.exe PID 4408 wrote to memory of 4888 4408 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Acunetix Premium Activation Tool.exe"C:\Users\Admin\AppData\Local\Temp\Acunetix Premium Activation Tool.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C net stop Acunetix2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop Acunetix3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Acunetix4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C net start Acunetix2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet start Acunetix3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start Acunetix4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://www.Dr-FarFar.com/2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dr-farfar.com/3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x78,0x104,0x7ffef07546f8,0x7ffef0754708,0x7ffef07547184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10353094997654572619,2003684978270588638,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10353094997654572619,2003684978270588638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10353094997654572619,2003684978270588638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10353094997654572619,2003684978270588638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10353094997654572619,2003684978270588638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,10353094997654572619,2003684978270588638,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4728 /prefetch:84⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\system32\drivers\etc\hostsFilesize
880B
MD5161ab7be7384a7815723aec470ddeb2f
SHA13e325c4d651f64d39944b45df0abc8b229c512c8
SHA256b46fe1dee909b7f8a4d73d7e59f1e4718d7a9c74680e87d5637be65877fa34e2
SHA512d52ba07f6e1c52e6baa3588efb051151174393dff1db563040c3c4476740c1d620312b4a462f3ebf2900b462b24a3900fb34a9e51a0686dc23c591f036b1bf26
-
\??\pipe\LOCAL\crashpad_4408_TJSPDUARSFCJXQULMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/448-144-0x0000000000000000-mapping.dmp
-
memory/620-137-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-152-0x00007FFF0DDF0000-0x00007FFF0DFE5000-memory.dmpFilesize
2.0MB
-
memory/620-135-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-136-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-130-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-138-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-139-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-140-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-141-0x00007FFF0DDF0000-0x00007FFF0DFE5000-memory.dmpFilesize
2.0MB
-
memory/620-131-0x00007FFF0DDF0000-0x00007FFF0DFE5000-memory.dmpFilesize
2.0MB
-
memory/620-132-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-133-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-134-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/620-151-0x00007FF7A6EA0000-0x00007FF7A7D35000-memory.dmpFilesize
14.6MB
-
memory/1012-163-0x0000000000000000-mapping.dmp
-
memory/1116-142-0x0000000000000000-mapping.dmp
-
memory/1580-156-0x0000000000000000-mapping.dmp
-
memory/1828-147-0x0000000000000000-mapping.dmp
-
memory/3796-165-0x0000000000000000-mapping.dmp
-
memory/4168-145-0x0000000000000000-mapping.dmp
-
memory/4408-149-0x0000000000000000-mapping.dmp
-
memory/4436-148-0x0000000000000000-mapping.dmp
-
memory/4460-143-0x0000000000000000-mapping.dmp
-
memory/4596-155-0x0000000000000000-mapping.dmp
-
memory/4888-159-0x0000000000000000-mapping.dmp
-
memory/4992-146-0x0000000000000000-mapping.dmp
-
memory/5100-161-0x0000000000000000-mapping.dmp
-
memory/5112-150-0x0000000000000000-mapping.dmp