qakbot | 25e4f8f33ec6b1d498b24622f833a2fb2b3a9a470e92759f31cd74d5726f5009

Analysis

max time kernel
154s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DEBT_07854_06162020.vbs
Size

2.6MB
MD5

66222018f11f64892cf65efeaade4e51
SHA1

c9a4282e5ba84aaeb136bf47b8ae04185f32af86
SHA256

116905c43d121cc4e1fdaa9ef2e89bb2f83a4c89b5fb400024f94c5cb06b9b09
SHA512

1b1fe70395a322e8e7450e881cda37a58ff614146f1f7e66346b4e13bddad66c1a1f7b5f3f7c2aa81e6e58d1379fe9f00eb1f481250fba4af2c6015814e18980

Score

10^/10

qakbot spx142 1592381263 banker cryptone evasion packer stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx142

Campaign

1592381263

173.175.29.210:443

201.248.102.4:2078

182.185.94.24:995

41.97.182.19:443

37.182.238.170:2222

193.248.44.2:2222

188.26.243.186:443

84.247.55.190:443

58.233.220.182:443

82.79.67.68:443

217.162.149.212:443

173.49.122.160:995

117.216.177.27:443

219.92.104.54:443

5.107.220.84:2222

96.41.93.96:443

122.147.204.4:443

117.199.5.99:443

68.60.221.169:465

78.96.192.26:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

CryptOne packer 8 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Churchill.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\Churchill.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\Churchill.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\Churchill.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe	cryptone

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exe

flow pid process

7 2452 WScript.exe
10 2452 WScript.exe
Executes dropped EXE 6 IoCs

Processes:

Churchill.exeChurchill.execkopiwu.execkopiwu.exeChurchill.execkopiwu.exe

pid process

2496 Churchill.exe
4612 Churchill.exe
4652 ckopiwu.exe
5044 ckopiwu.exe
1256 Churchill.exe
932 ckopiwu.exe

flow	pid	process
7	2452	WScript.exe
10	2452	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ckopiwu.exeChurchill.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	ckopiwu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	ckopiwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Churchill.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	Churchill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Churchill.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	Churchill.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	Churchill.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	Churchill.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	ckopiwu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	ckopiwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	ckopiwu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	ckopiwu.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4128 schtasks.exe

pid	process
4128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Churchill.exeChurchill.execkopiwu.execkopiwu.exeexplorer.exeChurchill.exe

pid	process
2496	Churchill.exe
2496	Churchill.exe
4612	Churchill.exe
4612	Churchill.exe
4612	Churchill.exe
4612	Churchill.exe
4652	ckopiwu.exe
4652	ckopiwu.exe
5044	ckopiwu.exe
5044	ckopiwu.exe
5044	ckopiwu.exe
5044	ckopiwu.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
4368	explorer.exe
1256	Churchill.exe
1256	Churchill.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ckopiwu.exe

pid process

4652 ckopiwu.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

WScript.exe

pid process

2452 WScript.exe

pid	process
4652	ckopiwu.exe

pid	process
2452	WScript.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

Churchill.execkopiwu.exeChurchill.exe

description	pid	process	target process
PID 2496 wrote to memory of 4612	2496	Churchill.exe	Churchill.exe
PID 2496 wrote to memory of 4612	2496	Churchill.exe	Churchill.exe
PID 2496 wrote to memory of 4612	2496	Churchill.exe	Churchill.exe
PID 2496 wrote to memory of 4652	2496	Churchill.exe	ckopiwu.exe
PID 2496 wrote to memory of 4652	2496	Churchill.exe	ckopiwu.exe
PID 2496 wrote to memory of 4652	2496	Churchill.exe	ckopiwu.exe
PID 2496 wrote to memory of 4128	2496	Churchill.exe	schtasks.exe
PID 2496 wrote to memory of 4128	2496	Churchill.exe	schtasks.exe
PID 2496 wrote to memory of 4128	2496	Churchill.exe	schtasks.exe
PID 4652 wrote to memory of 5044	4652	ckopiwu.exe	ckopiwu.exe
PID 4652 wrote to memory of 5044	4652	ckopiwu.exe	ckopiwu.exe
PID 4652 wrote to memory of 5044	4652	ckopiwu.exe	ckopiwu.exe
PID 4652 wrote to memory of 4368	4652	ckopiwu.exe	explorer.exe
PID 4652 wrote to memory of 4368	4652	ckopiwu.exe	explorer.exe
PID 4652 wrote to memory of 4368	4652	ckopiwu.exe	explorer.exe
PID 4652 wrote to memory of 4368	4652	ckopiwu.exe	explorer.exe
PID 1256 wrote to memory of 3112	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3112	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3624	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3624	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3384	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3384	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3312	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3312	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 1296	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 1296	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 2036	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 2036	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 2676	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 2676	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3588	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 3588	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 608	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 608	1256	Churchill.exe	reg.exe
PID 1256 wrote to memory of 932	1256	Churchill.exe	ckopiwu.exe
PID 1256 wrote to memory of 932	1256	Churchill.exe	ckopiwu.exe
PID 1256 wrote to memory of 932	1256	Churchill.exe	ckopiwu.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DEBT_07854_06162020.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
PID:2452

C:\Users\Admin\AppData\Local\Temp\Churchill.exe
C:\Users\Admin\AppData\Local\Temp\Churchill.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496

C:\Users\Admin\AppData\Local\Temp\Churchill.exe
C:\Users\Admin\AppData\Local\Temp\Churchill.exe /C
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4652

C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:5044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn aqiicwfafb /tr "\"C:\Users\Admin\AppData\Local\Temp\Churchill.exe\" /I aqiicwfafb" /SC ONCE /Z /ST 07:24 /ET 07:36
2⤵
- Creates scheduled task(s)
PID:4128

C:\Users\Admin\AppData\Local\Temp\Churchill.exe
C:\Users\Admin\AppData\Local\Temp\Churchill.exe /I aqiicwfafb
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3112

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3624

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3384

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3312

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:1296

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:2036

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:2676

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3588

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch" /d "0"
2⤵
PID:608

C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
2⤵
- Executes dropped EXE
PID:932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Churchill.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Churchill.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Churchill.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Churchill.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.dat
Filesize
63B

MD5
5f2d0366efd91406867ba846553b6a80

SHA1
b11dc6ab38e9f9ce867f5b020102fb29d065e258

SHA256
c7d19dab170099c50a50df54a791cf5b82c40b28d005ec3b248d702eac27340d

SHA512
5ea180303529428c9e809f844a67691fe1537fd4dbf26c640294122a03fd18ae81ed6fa54246fe2f5de59da999411487f38e5fc9715087d0e2cabb04af526d30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Labheyfch\ckopiwu.exe
Filesize
2.6MB

MD5
5004555240fa78e8e49483e33f7550c0

SHA1
4d51367638800728b94af5ba0b6d364c407c7773

SHA256
382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c

SHA512
874d12561cb2164309e8916fe54bed93d0166d8c738cde87244a99280200dd8663a25282a6bf812f116ef8f5de75c5f8e9cbc8c7fba0e6197ebe09b5e695fa60

Download Submit
memory/608-159-0x0000000000000000-mapping.dmp

Download
memory/932-160-0x0000000000000000-mapping.dmp

Download
memory/1256-150-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/1296-155-0x0000000000000000-mapping.dmp

Download
memory/2036-156-0x0000000000000000-mapping.dmp

Download
memory/2496-133-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/2496-132-0x0000000000950000-0x0000000000987000-memory.dmp

Filesize
220KB

Download
memory/2676-157-0x0000000000000000-mapping.dmp

Download
memory/3112-151-0x0000000000000000-mapping.dmp

Download
memory/3312-154-0x0000000000000000-mapping.dmp

Download
memory/3384-153-0x0000000000000000-mapping.dmp

Download
memory/3588-158-0x0000000000000000-mapping.dmp

Download
memory/3624-152-0x0000000000000000-mapping.dmp

Download
memory/4128-140-0x0000000000000000-mapping.dmp

Download
memory/4368-147-0x0000000000D80000-0x0000000000DB3000-memory.dmp

Filesize
204KB

Download
memory/4368-145-0x0000000000000000-mapping.dmp

Download
memory/4368-146-0x0000000000360000-0x000000000039A000-memory.dmp

Filesize
232KB

Download
memory/4612-136-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/4612-134-0x0000000000000000-mapping.dmp

Download
memory/4652-141-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/4652-137-0x0000000000000000-mapping.dmp

Download
memory/5044-144-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/5044-142-0x0000000000000000-mapping.dmp

Download