Analysis
-
max time kernel
180s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe
Resource
win7-20220901-en
General
-
Target
cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe
-
Size
2.5MB
-
MD5
31fbf8b89ac81155cce4ce995e4db8f0
-
SHA1
290e75beb35d7b1a87907aae0274e0131d467c89
-
SHA256
cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111
-
SHA512
3f70baea90d86c195b188924385cd98d8b15e7e0a70c06e2b6faba2a8451e284207d643c14fd2b5bae855d75216e273b06c20fd17d2818c97ef5ce785b0e4640
-
SSDEEP
49152:h1Os6CpYO/dJJDHhs6oxRkNfehWfNs4VGufZ9JODSTz4bkX:h1OCly7kNfrNq4X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
uDVrdPhY5IMFZ4h.exepid process 3120 uDVrdPhY5IMFZ4h.exe -
Loads dropped DLL 3 IoCs
Processes:
uDVrdPhY5IMFZ4h.exeregsvr32.exeregsvr32.exepid process 3120 uDVrdPhY5IMFZ4h.exe 4228 regsvr32.exe 4168 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
uDVrdPhY5IMFZ4h.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkabmengmkddnijinijibnfbfmdoofgi\2.0\manifest.json uDVrdPhY5IMFZ4h.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkabmengmkddnijinijibnfbfmdoofgi\2.0\manifest.json uDVrdPhY5IMFZ4h.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkabmengmkddnijinijibnfbfmdoofgi\2.0\manifest.json uDVrdPhY5IMFZ4h.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkabmengmkddnijinijibnfbfmdoofgi\2.0\manifest.json uDVrdPhY5IMFZ4h.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkabmengmkddnijinijibnfbfmdoofgi\2.0\manifest.json uDVrdPhY5IMFZ4h.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
uDVrdPhY5IMFZ4h.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} uDVrdPhY5IMFZ4h.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} uDVrdPhY5IMFZ4h.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects uDVrdPhY5IMFZ4h.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ uDVrdPhY5IMFZ4h.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
uDVrdPhY5IMFZ4h.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy uDVrdPhY5IMFZ4h.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini uDVrdPhY5IMFZ4h.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol uDVrdPhY5IMFZ4h.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI uDVrdPhY5IMFZ4h.exe -
Drops file in Program Files directory 8 IoCs
Processes:
uDVrdPhY5IMFZ4h.exedescription ioc process File opened for modification C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.tlb uDVrdPhY5IMFZ4h.exe File created C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.dat uDVrdPhY5IMFZ4h.exe File opened for modification C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.dat uDVrdPhY5IMFZ4h.exe File created C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dll uDVrdPhY5IMFZ4h.exe File opened for modification C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dll uDVrdPhY5IMFZ4h.exe File created C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.dll uDVrdPhY5IMFZ4h.exe File opened for modification C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.dll uDVrdPhY5IMFZ4h.exe File created C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.tlb uDVrdPhY5IMFZ4h.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
uDVrdPhY5IMFZ4h.exepid process 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe 3120 uDVrdPhY5IMFZ4h.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
uDVrdPhY5IMFZ4h.exedescription pid process Token: SeDebugPrivilege 3120 uDVrdPhY5IMFZ4h.exe Token: SeDebugPrivilege 3120 uDVrdPhY5IMFZ4h.exe Token: SeDebugPrivilege 3120 uDVrdPhY5IMFZ4h.exe Token: SeDebugPrivilege 3120 uDVrdPhY5IMFZ4h.exe Token: SeDebugPrivilege 3120 uDVrdPhY5IMFZ4h.exe Token: SeDebugPrivilege 3120 uDVrdPhY5IMFZ4h.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exeuDVrdPhY5IMFZ4h.exeregsvr32.exedescription pid process target process PID 3448 wrote to memory of 3120 3448 cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe uDVrdPhY5IMFZ4h.exe PID 3448 wrote to memory of 3120 3448 cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe uDVrdPhY5IMFZ4h.exe PID 3448 wrote to memory of 3120 3448 cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe uDVrdPhY5IMFZ4h.exe PID 3120 wrote to memory of 4228 3120 uDVrdPhY5IMFZ4h.exe regsvr32.exe PID 3120 wrote to memory of 4228 3120 uDVrdPhY5IMFZ4h.exe regsvr32.exe PID 3120 wrote to memory of 4228 3120 uDVrdPhY5IMFZ4h.exe regsvr32.exe PID 4228 wrote to memory of 4168 4228 regsvr32.exe regsvr32.exe PID 4228 wrote to memory of 4168 4228 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe"C:\Users\Admin\AppData\Local\Temp\cf2bb9ffb315d914dbf9ac5570a59d4378d875ec56fb29fef550b5664a6fb111.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\uDVrdPhY5IMFZ4h.exe.\uDVrdPhY5IMFZ4h.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.datFilesize
7KB
MD5dc91dfc27ccd63c9b72ca22058a0b3a8
SHA1bddb3ea61cecee22391af549122fef1b1eae25a0
SHA256d5cb823ec333349c2189a3f93baacb9313e6c90e9711901ff3fc92068ff6ef5a
SHA512d599d0884ab025c189ae544279cd49d4a1a2fc5715e537fcd4691add0f3a1facfeaa34eb58f600fa00de5aa10401fd76a43605439ae7849e6e74c083dcb46534
-
C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.dllFilesize
738KB
MD549961c7c9a7aef57f49adf50d1c810f6
SHA1fc2078aeff5d5abee27c9e8a500cb2d6ae755b05
SHA256c80abdc502d18db54137edc2680a498402c765999814b7fe1b2a7b69a64ce846
SHA5128ad2c3dbd3b4390e4c49561f25ff2acdd4ab4468074e213f3efc81a598f71620e8f21fc87114623a6c0509997e47e1c4f5ffe703c7421ae313f7ba536df2772f
-
C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dllFilesize
872KB
MD5337b97dbbcc7ad4d75fb5a90652e6de3
SHA150e50243af1819e62a7512d85e6dd67b8e1ed103
SHA256b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c
SHA512dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e
-
C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dllFilesize
872KB
MD5337b97dbbcc7ad4d75fb5a90652e6de3
SHA150e50243af1819e62a7512d85e6dd67b8e1ed103
SHA256b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c
SHA512dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e
-
C:\Program Files (x86)\GoSave\ounqeSLYYELyPb.x64.dllFilesize
872KB
MD5337b97dbbcc7ad4d75fb5a90652e6de3
SHA150e50243af1819e62a7512d85e6dd67b8e1ed103
SHA256b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c
SHA512dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\BQBHi@N.net\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\BQBHi@N.net\chrome.manifestFilesize
35B
MD5f8c3f63e8a14ec367a501cf75412d300
SHA1ab0e5d52e46347c914dc4b3e59c36b6ea83f74fb
SHA25635402a946af4f6f4df774c43120692e846c3ab3ee0830fa3761129e33dcac043
SHA5129d4a8511f6a0e9ecbf7cab3730a7c506944f69ea7fdfd5366ba7e27c8968be41e0327d381b73e6ef137087a2b3fb3e4a11d085bde0c87a178787d1501fa918d6
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\BQBHi@N.net\content\bg.jsFilesize
9KB
MD5970ddb03eaf112f3ad4c39957175427a
SHA161bf8dd79dd13eb0853a0796761d76444ab24cb2
SHA25682d8387010297651816eb893997a6d37f71188065b6a5943feddc471aabd2055
SHA5126e5b040c623b71fca99f69e9d5039a3bc6ae185981b7641c1d87ef3737c39c4a915d77b4e41d369dc0b3e22e37a4e3abf111f3eeabd06d760f3f3b251394dedc
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\BQBHi@N.net\install.rdfFilesize
594B
MD5b5fe007934a3b7ac0d2d10109cb9e59e
SHA108aa5d42622ad72c4947e8618e0e07c9bec20693
SHA2564fa7333fd8f8dab9d9e2096400519611c34b1c072fb6d680e497075a9c6c7684
SHA51273427332ebc8d17d31e7a518d6b801a83bf2c413d5bf5067ad9f70c727ba79cdd4d6db76359ffa95dffa3d82800b7d4082c81edb0710359d27f363953ce3fb9c
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\gkabmengmkddnijinijibnfbfmdoofgi\WC.jsFilesize
6KB
MD564118ae2042823fc3ef9dd6804ddf833
SHA1c0d594b9c6ea8b2d4262cf3170e7533e81a09b0f
SHA2563e4b51d69af1444d2373bf792c2610503d3a62f75f85954304da84e2e0e21dda
SHA512b53ffc1feeed482768f2229322f8a3bbdd1771af26fd66595eeab382257b3cf5c85fead571b1cd981a763a796eb933900c9f49b00964108f7d44775a026d76b6
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\gkabmengmkddnijinijibnfbfmdoofgi\background.htmlFilesize
139B
MD5b68e5f8d0cbd060d5b1d161da8b8e4df
SHA1ee548659ac5db721dcdd6428a4e28df6e55603c1
SHA2569522dd84f308abc1314ea6b342080f08098782497563005b2ab1913ebad8cafd
SHA5126b4a5362e9fffa311cefd27ed228fabe7771cde0d93d4b37d9b221e5b4e66080e1d1d0f7a90a984d95fd6b1a0658aa92659b378a3c6ce1912737772816e5ab22
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\gkabmengmkddnijinijibnfbfmdoofgi\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\gkabmengmkddnijinijibnfbfmdoofgi\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\gkabmengmkddnijinijibnfbfmdoofgi\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\ounqeSLYYELyPb.dllFilesize
738KB
MD549961c7c9a7aef57f49adf50d1c810f6
SHA1fc2078aeff5d5abee27c9e8a500cb2d6ae755b05
SHA256c80abdc502d18db54137edc2680a498402c765999814b7fe1b2a7b69a64ce846
SHA5128ad2c3dbd3b4390e4c49561f25ff2acdd4ab4468074e213f3efc81a598f71620e8f21fc87114623a6c0509997e47e1c4f5ffe703c7421ae313f7ba536df2772f
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\ounqeSLYYELyPb.tlbFilesize
3KB
MD5e3ab22d8beac0180520ab5289a64419b
SHA11456ba2c78b293e5a80185fefdf05f5dbe424937
SHA2560d3342857b67678dd76e6a24e137f0d75ba399bb48bf5095d7e4f7dfa0bbe416
SHA512c04163026ffa1c6fab34b4fdbf23702148c7c2a31dd356d26f9541027db078b6433aff3a5f749a209a3acbcf3a853a9b5f77984540e21be1f823ce92bcbfc4bf
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\ounqeSLYYELyPb.x64.dllFilesize
872KB
MD5337b97dbbcc7ad4d75fb5a90652e6de3
SHA150e50243af1819e62a7512d85e6dd67b8e1ed103
SHA256b501a7a1e233ac26b0ba2fbbf54cbb782f98bc5484537e584fcbf4dcf5cc3f0c
SHA512dab62835e885457c481d7ee4d76c1bc89278d5dc22178301629c78ad3215e1a4627a95f50b03587d8978e85cbba829f31acedf21c23773f5c526b0f76c8cf09e
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\uDVrdPhY5IMFZ4h.datFilesize
7KB
MD5dc91dfc27ccd63c9b72ca22058a0b3a8
SHA1bddb3ea61cecee22391af549122fef1b1eae25a0
SHA256d5cb823ec333349c2189a3f93baacb9313e6c90e9711901ff3fc92068ff6ef5a
SHA512d599d0884ab025c189ae544279cd49d4a1a2fc5715e537fcd4691add0f3a1facfeaa34eb58f600fa00de5aa10401fd76a43605439ae7849e6e74c083dcb46534
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\uDVrdPhY5IMFZ4h.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
C:\Users\Admin\AppData\Local\Temp\7zSDBED.tmp\uDVrdPhY5IMFZ4h.exeFilesize
772KB
MD55ed7019dcd0008dbcd8e54017b8c7dd9
SHA17e4457da2ff06c2170bad636c9eb7c1bb436fd06
SHA2567f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7
SHA51210cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db
-
memory/3120-132-0x0000000000000000-mapping.dmp
-
memory/4168-152-0x0000000000000000-mapping.dmp
-
memory/4228-149-0x0000000000000000-mapping.dmp