Analysis
-
max time kernel
166s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 01:59
Static task
static1
Behavioral task
behavioral1
Sample
49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe
Resource
win7-20221111-en
General
-
Target
49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe
-
Size
2.5MB
-
MD5
3fe39031c8af7a6264025c2a23e6a7a3
-
SHA1
0d5132ff6cb6f6437340600469fb886938f77099
-
SHA256
49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476
-
SHA512
6dbacc06b27268b82f79694cf4069c8019bdb82033d2888dc6995744d83fcd1a765d3c4f173cfabc689c0c6ce0f4a8d1cbf08e538382c410f18714cc0b8e2501
-
SSDEEP
49152:h1OsKPHVmVhYwiLtKkKyW4nFU0I+NP/f7I3lMOaYjdxvL0He:h1OFHVl71RnFXINxvR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
yWb5G1KZDGNYl6K.exepid process 1436 yWb5G1KZDGNYl6K.exe -
Loads dropped DLL 3 IoCs
Processes:
yWb5G1KZDGNYl6K.exeregsvr32.exeregsvr32.exepid process 1436 yWb5G1KZDGNYl6K.exe 1608 regsvr32.exe 3552 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
yWb5G1KZDGNYl6K.exedescription ioc process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\3.18\manifest.json yWb5G1KZDGNYl6K.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\3.18\manifest.json yWb5G1KZDGNYl6K.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\3.18\manifest.json yWb5G1KZDGNYl6K.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\3.18\manifest.json yWb5G1KZDGNYl6K.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjmbhlgjdijabcaplceeaeafjdpkeojo\3.18\manifest.json yWb5G1KZDGNYl6K.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
yWb5G1KZDGNYl6K.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ yWb5G1KZDGNYl6K.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} yWb5G1KZDGNYl6K.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects yWb5G1KZDGNYl6K.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} yWb5G1KZDGNYl6K.exe -
Drops file in System32 directory 4 IoCs
Processes:
yWb5G1KZDGNYl6K.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy yWb5G1KZDGNYl6K.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini yWb5G1KZDGNYl6K.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol yWb5G1KZDGNYl6K.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI yWb5G1KZDGNYl6K.exe -
Drops file in Program Files directory 8 IoCs
Processes:
yWb5G1KZDGNYl6K.exedescription ioc process File opened for modification C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.tlb yWb5G1KZDGNYl6K.exe File created C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.dat yWb5G1KZDGNYl6K.exe File opened for modification C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.dat yWb5G1KZDGNYl6K.exe File created C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dll yWb5G1KZDGNYl6K.exe File opened for modification C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dll yWb5G1KZDGNYl6K.exe File created C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.dll yWb5G1KZDGNYl6K.exe File opened for modification C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.dll yWb5G1KZDGNYl6K.exe File created C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.tlb yWb5G1KZDGNYl6K.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
yWb5G1KZDGNYl6K.exepid process 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe 1436 yWb5G1KZDGNYl6K.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
yWb5G1KZDGNYl6K.exedescription pid process Token: SeDebugPrivilege 1436 yWb5G1KZDGNYl6K.exe Token: SeDebugPrivilege 1436 yWb5G1KZDGNYl6K.exe Token: SeDebugPrivilege 1436 yWb5G1KZDGNYl6K.exe Token: SeDebugPrivilege 1436 yWb5G1KZDGNYl6K.exe Token: SeDebugPrivilege 1436 yWb5G1KZDGNYl6K.exe Token: SeDebugPrivilege 1436 yWb5G1KZDGNYl6K.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exeyWb5G1KZDGNYl6K.exeregsvr32.exedescription pid process target process PID 2548 wrote to memory of 1436 2548 49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe yWb5G1KZDGNYl6K.exe PID 2548 wrote to memory of 1436 2548 49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe yWb5G1KZDGNYl6K.exe PID 2548 wrote to memory of 1436 2548 49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe yWb5G1KZDGNYl6K.exe PID 1436 wrote to memory of 1608 1436 yWb5G1KZDGNYl6K.exe regsvr32.exe PID 1436 wrote to memory of 1608 1436 yWb5G1KZDGNYl6K.exe regsvr32.exe PID 1436 wrote to memory of 1608 1436 yWb5G1KZDGNYl6K.exe regsvr32.exe PID 1608 wrote to memory of 3552 1608 regsvr32.exe regsvr32.exe PID 1608 wrote to memory of 3552 1608 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe"C:\Users\Admin\AppData\Local\Temp\49269b523a50ec9da2cb05e68482d42fe03a44d4296d4ced8911dfed9a410476.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\yWb5G1KZDGNYl6K.exe.\yWb5G1KZDGNYl6K.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.datFilesize
7KB
MD5efeb016e7edf5efd5cdfdb30f1ef4b74
SHA1b1f0b76c2b6a846995a40445545ce37a765fa2f5
SHA2568445dc6b8de5c65b0784166b97a4013d0e26d8c85fb40098a1a10626da11116b
SHA5124798547dc093783324a3e543feea11ddf44d3952aecaac4afdb98933991923db41738c9c6c1867cc2767e882870d80876dadadba37f5bd739f77d74012d79c5c
-
C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.dllFilesize
747KB
MD5d949da968ea04ac3a7ddf0e300bb32be
SHA1581d7d799c538b8e9e578cf57c420fb802d5a201
SHA2565c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b
SHA512fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e
-
C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Program Files (x86)\OptOn\Apf8HBrE7YBMVu.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\Apf8HBrE7YBMVu.dllFilesize
747KB
MD5d949da968ea04ac3a7ddf0e300bb32be
SHA1581d7d799c538b8e9e578cf57c420fb802d5a201
SHA2565c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b
SHA512fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\Apf8HBrE7YBMVu.tlbFilesize
3KB
MD55b503f1b4056c3d4fbf2d03f88e1adfe
SHA1c8d659ea27bf0ca0bbfd46865d5796589bf9ef68
SHA256231ef0fef77ab6c7fea053f64a9ce7f9e21646b868bfe391962262fc15c9bb6c
SHA512229207201368d9674258389df19132070390f913aa5cc21b7567c515be5f5e0f07cdaa460d497ae355f27f00f7fc75538783d8890f6c9c0e861a7ecb8f520bdb
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\Apf8HBrE7YBMVu.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\[email protected]\chrome.manifestFilesize
35B
MD5aff189fdba8f3ed7a6d096d784bce3cb
SHA178e904020b2b6c35e3d1d181dfdf8bd1d8082c96
SHA2565857536a05ba6b16e42cc020f9d981453c975c14ea952cef51378c4b07074cdc
SHA5129190cfc3f08d9d3b19daaf178cdb538db1e597e9cb77c87c100b28c1f7cc1359405c8191553c363c9fc49ce62d220f3e9d4f589a4d675d870933a2dde52e636d
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\[email protected]\content\bg.jsFilesize
8KB
MD5cedc3ef9e025e1db4f84fed28d9988fe
SHA15316f629e1f604cc64c042454d0b8e45ddbbe6ba
SHA256e1374aef3adcf252f16256a87d46c9561f8afccff6f523eff4107176c2d265fe
SHA51247ae5c6ca34482702c624e8274996b2539d30f39664c1a7c00cc6790bb221ef323a81c4306ecd98f9460ede75a4b3906487b09e3dd194d50a4b938948fa83f5e
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\[email protected]\install.rdfFilesize
593B
MD5fab48e0052707c612c467d915e5fda29
SHA1ac04ca3445c05bada18133430616b39a55678639
SHA256cbb3ad5a148afc312231509e05c9c49cf0b03ca6245658758f1aff4bf2cb6347
SHA512a03736c3ebe0548a7e0e740eaa6511277925466f9d42de5c6de36f22ebcdd2cea1aba922e42aa641c5b39f75b60121f53356edcc1ccac46e78b9cd2fa08b65d2
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\background.htmlFilesize
140B
MD55414510b7eeab743131a7d0b8ff535d2
SHA1346573b7807869f2e1b65c0fc2ac407ea73d4c98
SHA256123494a76e4692326307f352d3c20af8ce286e0570c7e32374adb0cd9a17b123
SHA5123a7877e0df314e47b03d0d8bac7ac1e1eb77d4c4a528eb9142cc1e1d13a6b8117221001997805212abfae6c093ef5f0eeca45cfc1da785db709a7322fd2e80a6
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\eRI.jsFilesize
6KB
MD54b9b6b38abd5696b69497ede76a609bf
SHA15144ca4a78003e41a6c6a6fda35407bb98f19c22
SHA256a148f781f39384bee7c7f2da3af50aa5564cd21681c616c447ab723f1bdb528c
SHA512198ebdc001cbfd0cae4178b94c9d69e3fc37511b5048eae342fc04b7aa5d0eb4c9248b07ae694572e9327e88a0bf3b99a2e55312a7d67c2eab859def09767c02
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\pjmbhlgjdijabcaplceeaeafjdpkeojo\manifest.jsonFilesize
498B
MD55b115b5073dd285128eb6eea5e2f205a
SHA19b092a8bf15b554c0d5f3e3bedd67567e5bf32ce
SHA2568d6e3c32c0e320ea38450aa10c4aaa18a49ebf75dcf5d61fc13b469b04f38b82
SHA5124a40c4dbc6218caec57112a60c42e078b4f4a57e23ba6095a59f0708a54d9d66168639cf26efc7f63434bec165c68dd82bcbd74114b0b73b7cb234dc43b1a918
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\yWb5G1KZDGNYl6K.datFilesize
7KB
MD5efeb016e7edf5efd5cdfdb30f1ef4b74
SHA1b1f0b76c2b6a846995a40445545ce37a765fa2f5
SHA2568445dc6b8de5c65b0784166b97a4013d0e26d8c85fb40098a1a10626da11116b
SHA5124798547dc093783324a3e543feea11ddf44d3952aecaac4afdb98933991923db41738c9c6c1867cc2767e882870d80876dadadba37f5bd739f77d74012d79c5c
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\yWb5G1KZDGNYl6K.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS3374.tmp\yWb5G1KZDGNYl6K.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1436-132-0x0000000000000000-mapping.dmp
-
memory/1608-149-0x0000000000000000-mapping.dmp
-
memory/3552-152-0x0000000000000000-mapping.dmp