Analysis
-
max time kernel
158s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe
Resource
win7-20221111-en
General
-
Target
cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe
-
Size
2.5MB
-
MD5
e44b505b118692214e8c6422163a2874
-
SHA1
073f90c250c92b68820d3dc214b9c36c2ff15898
-
SHA256
cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f
-
SHA512
ab0a3104ff842030b8285e9a02c15410ec290a35da3c34c422d487b61633d42ed326626b9e0bbbb390ec325669cf8dc77599f079a97ce1e1cb1479b4f172a5b8
-
SSDEEP
49152:h1OsaPHVmVhYwiLtKkKyW4nFU0I+NP/f7I3lMOaYjdxvL0HG:h1OtHVl71RnFXINxvX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ydEJgQMbETGFrJI.exepid process 4376 ydEJgQMbETGFrJI.exe -
Loads dropped DLL 3 IoCs
Processes:
ydEJgQMbETGFrJI.exeregsvr32.exeregsvr32.exepid process 4376 ydEJgQMbETGFrJI.exe 1128 regsvr32.exe 3000 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
ydEJgQMbETGFrJI.exedescription ioc process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdpikeceobhmmhgjjgpfhmnkglkdgki\2.0\manifest.json ydEJgQMbETGFrJI.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdpikeceobhmmhgjjgpfhmnkglkdgki\2.0\manifest.json ydEJgQMbETGFrJI.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdpikeceobhmmhgjjgpfhmnkglkdgki\2.0\manifest.json ydEJgQMbETGFrJI.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdpikeceobhmmhgjjgpfhmnkglkdgki\2.0\manifest.json ydEJgQMbETGFrJI.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmdpikeceobhmmhgjjgpfhmnkglkdgki\2.0\manifest.json ydEJgQMbETGFrJI.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
ydEJgQMbETGFrJI.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} ydEJgQMbETGFrJI.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} ydEJgQMbETGFrJI.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects ydEJgQMbETGFrJI.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ydEJgQMbETGFrJI.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
ydEJgQMbETGFrJI.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol ydEJgQMbETGFrJI.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI ydEJgQMbETGFrJI.exe File opened for modification C:\Windows\System32\GroupPolicy ydEJgQMbETGFrJI.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini ydEJgQMbETGFrJI.exe -
Drops file in Program Files directory 8 IoCs
Processes:
ydEJgQMbETGFrJI.exedescription ioc process File opened for modification C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.dat ydEJgQMbETGFrJI.exe File created C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dll ydEJgQMbETGFrJI.exe File opened for modification C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dll ydEJgQMbETGFrJI.exe File created C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.dll ydEJgQMbETGFrJI.exe File opened for modification C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.dll ydEJgQMbETGFrJI.exe File created C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.tlb ydEJgQMbETGFrJI.exe File opened for modification C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.tlb ydEJgQMbETGFrJI.exe File created C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.dat ydEJgQMbETGFrJI.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
ydEJgQMbETGFrJI.exepid process 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe 4376 ydEJgQMbETGFrJI.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ydEJgQMbETGFrJI.exedescription pid process Token: SeDebugPrivilege 4376 ydEJgQMbETGFrJI.exe Token: SeDebugPrivilege 4376 ydEJgQMbETGFrJI.exe Token: SeDebugPrivilege 4376 ydEJgQMbETGFrJI.exe Token: SeDebugPrivilege 4376 ydEJgQMbETGFrJI.exe Token: SeDebugPrivilege 4376 ydEJgQMbETGFrJI.exe Token: SeDebugPrivilege 4376 ydEJgQMbETGFrJI.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exeydEJgQMbETGFrJI.exeregsvr32.exedescription pid process target process PID 3448 wrote to memory of 4376 3448 cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe ydEJgQMbETGFrJI.exe PID 3448 wrote to memory of 4376 3448 cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe ydEJgQMbETGFrJI.exe PID 3448 wrote to memory of 4376 3448 cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe ydEJgQMbETGFrJI.exe PID 4376 wrote to memory of 1128 4376 ydEJgQMbETGFrJI.exe regsvr32.exe PID 4376 wrote to memory of 1128 4376 ydEJgQMbETGFrJI.exe regsvr32.exe PID 4376 wrote to memory of 1128 4376 ydEJgQMbETGFrJI.exe regsvr32.exe PID 1128 wrote to memory of 3000 1128 regsvr32.exe regsvr32.exe PID 1128 wrote to memory of 3000 1128 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe"C:\Users\Admin\AppData\Local\Temp\cef96cb6483eccfaff3aa89e6840cb1cd646e7466e976cb40c05d3e8be437d8f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\ydEJgQMbETGFrJI.exe.\ydEJgQMbETGFrJI.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.datFilesize
7KB
MD5053f2e52bb28ce2b6c9c61822c7dbd88
SHA1472ba4bec74b6d2792f7164ed3745f79dd4a768c
SHA256d458893dc2138c4790cd9dab49d6c31c1dcd5d50ab6d736f2ac0a1f6d06e9f02
SHA51219aa8fea7e6128f28dc630d57e3e8d2047732fe62812be9e5290a1060c9504d598724e7131979951d46892a9683013589a168a9c6d90bae1b560b097bdeb4725
-
C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.dllFilesize
747KB
MD5d949da968ea04ac3a7ddf0e300bb32be
SHA1581d7d799c538b8e9e578cf57c420fb802d5a201
SHA2565c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b
SHA512fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e
-
C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Program Files (x86)\GoSave\JvNsaAkVR7nAht.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\JvNsaAkVR7nAht.dllFilesize
747KB
MD5d949da968ea04ac3a7ddf0e300bb32be
SHA1581d7d799c538b8e9e578cf57c420fb802d5a201
SHA2565c4756451acf8622efa75639f9131ca8215c165e2ef21cc1ab7f8fee77db462b
SHA512fd00e332af52646425f0d4032bb1bbfc85a44ff274bcf212f1264a29be546db4c1ceab7da32c70248a6baa2c55d2dff47dcb2ac441c783a1d9d1260c4685eb7e
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\JvNsaAkVR7nAht.tlbFilesize
3KB
MD55b503f1b4056c3d4fbf2d03f88e1adfe
SHA1c8d659ea27bf0ca0bbfd46865d5796589bf9ef68
SHA256231ef0fef77ab6c7fea053f64a9ce7f9e21646b868bfe391962262fc15c9bb6c
SHA512229207201368d9674258389df19132070390f913aa5cc21b7567c515be5f5e0f07cdaa460d497ae355f27f00f7fc75538783d8890f6c9c0e861a7ecb8f520bdb
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\JvNsaAkVR7nAht.x64.dllFilesize
885KB
MD51a6b1013f17c1cdc6e98f82cd2568ea8
SHA1c96e7bdba616743a5c05b08a342d89ed102376b0
SHA256fa9dd2bd7850053b251c9b5f27f1ac43ad04abf85de61b1928b7c2d562d3290a
SHA51210596f46c52ca3f50d6b3c7c894fff8b41f4fe920c6e5e0138cf7e95e85bfe1db8d5f1a63939832cd48cf29f571dd36de40ebb931fb9b14a106518ae4fc17ef9
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nZ4lx@0.org\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nZ4lx@0.org\chrome.manifestFilesize
35B
MD5aa9d95b2e780ae3b06a7e17101e0afd1
SHA1ca3a3d675d66f372dd1d9321bfb6c7e497688801
SHA2568689953c78cad2c465ce71be82924e3c79020c759b51f8676320753cd3b27739
SHA512c2d8dbeeb2270eba6a887581ee15c82b3063585683a4ea2d9f3543804e145a0be83ab72c889501cf85d073e0c147a490ecc70e1f05a0d09971a99990556abb38
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nZ4lx@0.org\content\bg.jsFilesize
9KB
MD5365c88f6962873c5254f60dad37838ff
SHA1c74fac55aeacbe26291e061a50197d4842174dad
SHA2566ee95000cbb1382d210b2a93b5c4bbf7379d461afd8e5d0f28f7969deb9a6a09
SHA5127086949111ead3f92818462c2d5a48f483abb594ef47b898de90c59ea56d5120fac4b2601c945cfce0ccd7c8a53a1ce86b7a318fbeed007a849a2caebd71e22b
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nZ4lx@0.org\install.rdfFilesize
593B
MD5a8b1c9b75357ead6cc6e7aded4e49a19
SHA147f1e3f0616d7b850a912d2f3c1fb812be56e833
SHA25637e7fe2862024eac1290298e4b297257078be44df7413f537ba1d8127bb9361b
SHA5122823c5fde9938916c8124f546983883798791999a3171c714733ca3df2dffc1d7b2122e3a8a90afee6a9c2874e404c496b3a6beaa38819ea919142dca712528e
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nmdpikeceobhmmhgjjgpfhmnkglkdgki\V.jsFilesize
6KB
MD540cdd4d382525839e0f732cc3abdb9e9
SHA13fa5af4824dfd2505d141da1b0d2884c34bc7de6
SHA2567f1015f65d46a589f2c36d14cdcb894c8993e036f2c398476582f54e3333e17a
SHA5121868e896d8b39559b4ef5a54700972e4c0aaf51571a7734764e76c499d2c9155c4a5e3573cbb18b0f45aa53745b19ceb08882629346257cbefa160f64b3ca88b
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nmdpikeceobhmmhgjjgpfhmnkglkdgki\background.htmlFilesize
138B
MD53277689f25674eb8e3246ad1de2669cb
SHA1b413511c9dedaf14d3635ad6e5f5e150c6d6d124
SHA256d532a887e4d2bf6f301a48ae7dba950259076bd75359231578e320b894fc36d7
SHA512fe45d730d5d57f6f2448c0db979e3da602b57e1602084ce7684139f0ddbff172bd25455efc86bcf873eada1aa4625042775e2ec820d707cbd6406c1691f15268
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nmdpikeceobhmmhgjjgpfhmnkglkdgki\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nmdpikeceobhmmhgjjgpfhmnkglkdgki\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\nmdpikeceobhmmhgjjgpfhmnkglkdgki\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\ydEJgQMbETGFrJI.datFilesize
7KB
MD5053f2e52bb28ce2b6c9c61822c7dbd88
SHA1472ba4bec74b6d2792f7164ed3745f79dd4a768c
SHA256d458893dc2138c4790cd9dab49d6c31c1dcd5d50ab6d736f2ac0a1f6d06e9f02
SHA51219aa8fea7e6128f28dc630d57e3e8d2047732fe62812be9e5290a1060c9504d598724e7131979951d46892a9683013589a168a9c6d90bae1b560b097bdeb4725
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\ydEJgQMbETGFrJI.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS2B65.tmp\ydEJgQMbETGFrJI.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
memory/1128-149-0x0000000000000000-mapping.dmp
-
memory/3000-152-0x0000000000000000-mapping.dmp
-
memory/4376-132-0x0000000000000000-mapping.dmp