Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 12:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe
-
Size
1.3MB
-
MD5
8a16967ee620b6d50578ec90143e9b88
-
SHA1
8b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
-
SHA256
f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
-
SHA512
f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
Malware Config
Extracted
remcos
wedsazxcvfghyuiokjhbnvfcdsaweyplmhbvrtud.ydns.eu:1996
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
win.exewin.exepid process 340 win.exe 1404 win.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeWerFault.exepid process 288 cmd.exe 288 cmd.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exewin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ win.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" win.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exewin.exepid process 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 340 win.exe 340 win.exe 340 win.exe 340 win.exe 340 win.exe 340 win.exe 340 win.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exewin.exedescription pid process target process PID 932 set thread context of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 340 set thread context of 1404 340 win.exe win.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1476 340 WerFault.exe win.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 2008 timeout.exe 920 timeout.exe 1768 timeout.exe 1348 timeout.exe 1468 timeout.exe 1660 timeout.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exewin.exeWerFault.exepid process 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe 340 win.exe 340 win.exe 340 win.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exewin.exeWerFault.exedescription pid process Token: SeDebugPrivilege 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe Token: SeDebugPrivilege 340 win.exe Token: SeDebugPrivilege 1476 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
win.exepid process 1404 win.exe -
Suspicious use of WriteProcessMemory 86 IoCs
Processes:
SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.execmd.execmd.execmd.exeSecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exeWScript.execmd.exewin.execmd.execmd.exedescription pid process target process PID 932 wrote to memory of 1980 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 1980 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 1980 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 1980 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 1980 wrote to memory of 1768 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 1768 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 1768 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 1768 1980 cmd.exe timeout.exe PID 932 wrote to memory of 1404 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 1404 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 1404 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 1404 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 1404 wrote to memory of 1348 1404 cmd.exe timeout.exe PID 1404 wrote to memory of 1348 1404 cmd.exe timeout.exe PID 1404 wrote to memory of 1348 1404 cmd.exe timeout.exe PID 1404 wrote to memory of 1348 1404 cmd.exe timeout.exe PID 932 wrote to memory of 268 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 268 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 268 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 932 wrote to memory of 268 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe cmd.exe PID 268 wrote to memory of 1468 268 cmd.exe timeout.exe PID 268 wrote to memory of 1468 268 cmd.exe timeout.exe PID 268 wrote to memory of 1468 268 cmd.exe timeout.exe PID 268 wrote to memory of 1468 268 cmd.exe timeout.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 932 wrote to memory of 1208 932 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe PID 1208 wrote to memory of 1524 1208 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe WScript.exe PID 1208 wrote to memory of 1524 1208 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe WScript.exe PID 1208 wrote to memory of 1524 1208 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe WScript.exe PID 1208 wrote to memory of 1524 1208 SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe WScript.exe PID 1524 wrote to memory of 288 1524 WScript.exe cmd.exe PID 1524 wrote to memory of 288 1524 WScript.exe cmd.exe PID 1524 wrote to memory of 288 1524 WScript.exe cmd.exe PID 1524 wrote to memory of 288 1524 WScript.exe cmd.exe PID 288 wrote to memory of 340 288 cmd.exe win.exe PID 288 wrote to memory of 340 288 cmd.exe win.exe PID 288 wrote to memory of 340 288 cmd.exe win.exe PID 288 wrote to memory of 340 288 cmd.exe win.exe PID 340 wrote to memory of 2032 340 win.exe cmd.exe PID 340 wrote to memory of 2032 340 win.exe cmd.exe PID 340 wrote to memory of 2032 340 win.exe cmd.exe PID 340 wrote to memory of 2032 340 win.exe cmd.exe PID 2032 wrote to memory of 1660 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1660 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1660 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1660 2032 cmd.exe timeout.exe PID 340 wrote to memory of 1964 340 win.exe cmd.exe PID 340 wrote to memory of 1964 340 win.exe cmd.exe PID 340 wrote to memory of 1964 340 win.exe cmd.exe PID 340 wrote to memory of 1964 340 win.exe cmd.exe PID 1964 wrote to memory of 2008 1964 cmd.exe timeout.exe PID 1964 wrote to memory of 2008 1964 cmd.exe timeout.exe PID 1964 wrote to memory of 2008 1964 cmd.exe timeout.exe PID 1964 wrote to memory of 2008 1964 cmd.exe timeout.exe PID 340 wrote to memory of 904 340 win.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.8a16967ee620b6d5.22788.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\win.exeC:\Users\Admin\AppData\Roaming\win.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 6006⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
4a74e626596d6e66b4bbc59ee6848f2d
SHA1047849ac8735ecc0943428c7cd5e00b52eee06ed
SHA25698bd6dc219a7a3e04d3d67bbec9f0b4d4640831a3a6be0a0078b050041088b0e
SHA5121cd943482d0f1ce2ffaf6ee4a82895e4d57c52051bb14bbda0548cf072b4c5cbe719d2cdb549b5ae7c0241dd9c68dd9d1674acd26aed684b8145500079cc5403
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
\Users\Admin\AppData\Roaming\win.exeMD5
8a16967ee620b6d50578ec90143e9b88
SHA18b3ab5b20d8fbcb5c5428768c7e3fe8f3a954a8f
SHA256f64dfe37f4518739d7d31f0a81cc8a126d6766ca16039b3f80a50495efd6d765
SHA512f0fe9ee56e17ef17fc0a1fb70f6f37946f93fc4ad0d2eb9bb9ade5429ace6a027e5a4fa5ee6a993de7474f7106e45a6543d9e3adf98a63d002e75c447b1869d1
-
memory/268-10-0x0000000000000000-mapping.dmp
-
memory/288-18-0x0000000000000000-mapping.dmp
-
memory/340-25-0x00000000734A0000-0x0000000073B8E000-memory.dmpFilesize
6.9MB
-
memory/340-26-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/340-23-0x0000000000000000-mapping.dmp
-
memory/904-33-0x0000000000000000-mapping.dmp
-
memory/920-34-0x0000000000000000-mapping.dmp
-
memory/932-2-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/932-3-0x0000000001320000-0x0000000001321000-memory.dmpFilesize
4KB
-
memory/932-5-0x0000000000270000-0x000000000029F000-memory.dmpFilesize
188KB
-
memory/1208-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1208-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1208-13-0x0000000000413FA4-mapping.dmp
-
memory/1348-9-0x0000000000000000-mapping.dmp
-
memory/1404-8-0x0000000000000000-mapping.dmp
-
memory/1404-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1404-36-0x0000000000413FA4-mapping.dmp
-
memory/1468-11-0x0000000000000000-mapping.dmp
-
memory/1476-39-0x0000000000000000-mapping.dmp
-
memory/1476-40-0x0000000001E30000-0x0000000001E41000-memory.dmpFilesize
68KB
-
memory/1524-19-0x00000000027A0000-0x00000000027A4000-memory.dmpFilesize
16KB
-
memory/1524-16-0x0000000000000000-mapping.dmp
-
memory/1660-30-0x0000000000000000-mapping.dmp
-
memory/1768-7-0x0000000000000000-mapping.dmp
-
memory/1964-31-0x0000000000000000-mapping.dmp
-
memory/1980-6-0x0000000000000000-mapping.dmp
-
memory/2008-32-0x0000000000000000-mapping.dmp
-
memory/2032-29-0x0000000000000000-mapping.dmp