Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-01-2021 20:07
Static task
static1
Behavioral task
behavioral1
Sample
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe
Resource
win7v20201028
General
-
Target
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe
-
Size
1.0MB
-
MD5
2596a24f0668203076e4829fa72dcfe7
-
SHA1
6d47cd0fa430e89e98931c487a179de58b943521
-
SHA256
009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
-
SHA512
267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
Malware Config
Extracted
asyncrat
0.5.7B
productos.linkpc.net:3470
AsyncMutex_6SI8OkPnk
-
aes_key
cRDJUz3TELGT8tZPsxRbzbKFZunEqWvB
-
anti_detection
false
-
autorun
true
-
bdos
false
-
delay
Default
-
host
productos.linkpc.net
-
hwid
3
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
3470
-
version
0.5.7B
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2836-15-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/2836-16-0x000000000040C76E-mapping.dmp asyncrat behavioral2/memory/3172-46-0x000000000040C76E-mapping.dmp asyncrat behavioral2/memory/3172-56-0x00000000070C0000-0x00000000070DB000-memory.dmp asyncrat -
Executes dropped EXE 4 IoCs
Processes:
dllwindefenderp.exedllwindefenderp.exedllwindefenderp.exetjzkey.exepid process 3828 dllwindefenderp.exe 3432 dllwindefenderp.exe 3172 dllwindefenderp.exe 984 tjzkey.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exedescription pid process target process PID 2724 set thread context of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 3828 set thread context of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2112 timeout.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exedllwindefenderp.exepowershell.exepid process 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe 3828 dllwindefenderp.exe 3828 dllwindefenderp.exe 3172 dllwindefenderp.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exedllwindefenderp.exedllwindefenderp.exepowershell.exedescription pid process Token: SeDebugPrivilege 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe Token: SeDebugPrivilege 3828 dllwindefenderp.exe Token: SeDebugPrivilege 3172 dllwindefenderp.exe Token: SeDebugPrivilege 2756 powershell.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exepdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.execmd.execmd.exedllwindefenderp.exedllwindefenderp.execmd.exepowershell.exedescription pid process target process PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2724 wrote to memory of 2836 2724 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe PID 2836 wrote to memory of 3996 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2836 wrote to memory of 3996 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2836 wrote to memory of 3996 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2836 wrote to memory of 4032 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2836 wrote to memory of 4032 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 2836 wrote to memory of 4032 2836 pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe cmd.exe PID 3996 wrote to memory of 3952 3996 cmd.exe schtasks.exe PID 3996 wrote to memory of 3952 3996 cmd.exe schtasks.exe PID 3996 wrote to memory of 3952 3996 cmd.exe schtasks.exe PID 4032 wrote to memory of 2112 4032 cmd.exe timeout.exe PID 4032 wrote to memory of 2112 4032 cmd.exe timeout.exe PID 4032 wrote to memory of 2112 4032 cmd.exe timeout.exe PID 4032 wrote to memory of 3828 4032 cmd.exe dllwindefenderp.exe PID 4032 wrote to memory of 3828 4032 cmd.exe dllwindefenderp.exe PID 4032 wrote to memory of 3828 4032 cmd.exe dllwindefenderp.exe PID 3828 wrote to memory of 3432 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3432 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3432 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3828 wrote to memory of 3172 3828 dllwindefenderp.exe dllwindefenderp.exe PID 3172 wrote to memory of 1132 3172 dllwindefenderp.exe cmd.exe PID 3172 wrote to memory of 1132 3172 dllwindefenderp.exe cmd.exe PID 3172 wrote to memory of 1132 3172 dllwindefenderp.exe cmd.exe PID 1132 wrote to memory of 2756 1132 cmd.exe powershell.exe PID 1132 wrote to memory of 2756 1132 cmd.exe powershell.exe PID 1132 wrote to memory of 2756 1132 cmd.exe powershell.exe PID 2756 wrote to memory of 984 2756 powershell.exe tjzkey.exe PID 2756 wrote to memory of 984 2756 powershell.exe tjzkey.exe PID 2756 wrote to memory of 984 2756 powershell.exe tjzkey.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"C:\Users\Admin\AppData\Local\Temp\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllwindefenderp" /tr '"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dllwindefenderp" /tr '"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6C96.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"C:\Users\Admin\AppData\Roaming\dllwindefenderp.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tjzkey.exe"' & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tjzkey.exe"'7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tjzkey.exe"C:\Users\Admin\AppData\Local\Temp\tjzkey.exe"8⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dllwindefenderp.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdfcartaembargodianreferencianullbywwwdiangovgoverenlinescartadeuda.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\tjzkey.exeMD5
9216769b1d4d22bab2f52286af332d9a
SHA1571211c7e9b0756f7ad37b4caf635a598dc7187f
SHA2569f0d41153879ec3295eb9e98efcecb25922500fd950c3a2d7d7990d98505396c
SHA512a5625fb9c77e3c80bb31fb0ce3fb4a070882403a43aa66cdb4eb2ac5cc28a6399b592833901bf599d6573cd106d0e220a7d25218d6be0ddb4f3637f4a47c6255
-
C:\Users\Admin\AppData\Local\Temp\tjzkey.exeMD5
9216769b1d4d22bab2f52286af332d9a
SHA1571211c7e9b0756f7ad37b4caf635a598dc7187f
SHA2569f0d41153879ec3295eb9e98efcecb25922500fd950c3a2d7d7990d98505396c
SHA512a5625fb9c77e3c80bb31fb0ce3fb4a070882403a43aa66cdb4eb2ac5cc28a6399b592833901bf599d6573cd106d0e220a7d25218d6be0ddb4f3637f4a47c6255
-
C:\Users\Admin\AppData\Local\Temp\tmp6C96.tmp.batMD5
33f8c0005e60615682d08902f19fb946
SHA107edcd394bba52f2bc38066b4bab210dd8ec1512
SHA256fb6cbefe98e78f7bfd17d4a469003701c95143e774c8e39410e9ecf74768c479
SHA51216d89255505bd6493f5bd4bc9de590855cf2b30ed60f079674ccedaa5688677f10bc754e4a2e2dcf35814f00449932a342500c3cf10996d23c0db0d4a490d914
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
C:\Users\Admin\AppData\Roaming\dllwindefenderp.exeMD5
2596a24f0668203076e4829fa72dcfe7
SHA16d47cd0fa430e89e98931c487a179de58b943521
SHA256009836a304833c35cb2336b438f32f29ef113887402f93fe0664505ee7bed246
SHA512267359ee0fc829a8d7a7eb954203a238164ec3b397c714c3836241c001d7b90a6dc10720c524a60460597b3a54e47d3e5441dd208bb5a0bcccf7bcfae9432e0e
-
memory/984-76-0x0000000000000000-mapping.dmp
-
memory/984-86-0x0000000004E00000-0x0000000004E12000-memory.dmpFilesize
72KB
-
memory/984-78-0x0000000073830000-0x0000000073F1E000-memory.dmpFilesize
6.9MB
-
memory/984-79-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1132-58-0x0000000000000000-mapping.dmp
-
memory/2112-26-0x0000000000000000-mapping.dmp
-
memory/2724-14-0x00000000058D0000-0x000000000593C000-memory.dmpFilesize
432KB
-
memory/2724-5-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/2724-3-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2724-2-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/2724-6-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/2724-12-0x0000000005230000-0x0000000005238000-memory.dmpFilesize
32KB
-
memory/2724-11-0x0000000005A20000-0x0000000005AAA000-memory.dmpFilesize
552KB
-
memory/2724-10-0x0000000004E20000-0x0000000004E32000-memory.dmpFilesize
72KB
-
memory/2724-9-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2724-8-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/2724-7-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/2756-69-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/2756-67-0x0000000007680000-0x0000000007681000-memory.dmpFilesize
4KB
-
memory/2756-65-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/2756-72-0x00000000089D0000-0x00000000089D1000-memory.dmpFilesize
4KB
-
memory/2756-73-0x0000000008A30000-0x0000000008A31000-memory.dmpFilesize
4KB
-
memory/2756-71-0x0000000008D00000-0x0000000008D01000-memory.dmpFilesize
4KB
-
memory/2756-63-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB
-
memory/2756-68-0x0000000007A10000-0x0000000007A11000-memory.dmpFilesize
4KB
-
memory/2756-64-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/2756-60-0x0000000000000000-mapping.dmp
-
memory/2756-59-0x0000000000000000-mapping.dmp
-
memory/2756-61-0x0000000073830000-0x0000000073F1E000-memory.dmpFilesize
6.9MB
-
memory/2756-62-0x00000000041E0000-0x00000000041E1000-memory.dmpFilesize
4KB
-
memory/2836-15-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2836-16-0x000000000040C76E-mapping.dmp
-
memory/2836-18-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/3172-54-0x00000000062F0000-0x00000000062F1000-memory.dmpFilesize
4KB
-
memory/3172-88-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/3172-56-0x00000000070C0000-0x00000000070DB000-memory.dmpFilesize
108KB
-
memory/3172-55-0x0000000007140000-0x0000000007141000-memory.dmpFilesize
4KB
-
memory/3172-49-0x0000000073830000-0x0000000073F1E000-memory.dmpFilesize
6.9MB
-
memory/3172-46-0x000000000040C76E-mapping.dmp
-
memory/3172-92-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/3172-91-0x0000000007600000-0x0000000007659000-memory.dmpFilesize
356KB
-
memory/3172-90-0x0000000007DA0000-0x0000000007E2D000-memory.dmpFilesize
564KB
-
memory/3172-89-0x00000000074D0000-0x00000000074D4000-memory.dmpFilesize
16KB
-
memory/3172-57-0x00000000071C0000-0x00000000071C1000-memory.dmpFilesize
4KB
-
memory/3172-87-0x0000000007580000-0x00000000075F9000-memory.dmpFilesize
484KB
-
memory/3828-27-0x0000000000000000-mapping.dmp
-
memory/3828-28-0x0000000000000000-mapping.dmp
-
memory/3828-31-0x0000000073830000-0x0000000073F1E000-memory.dmpFilesize
6.9MB
-
memory/3952-25-0x0000000000000000-mapping.dmp
-
memory/3996-22-0x0000000000000000-mapping.dmp
-
memory/4032-23-0x0000000000000000-mapping.dmp