Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 04:05
Static task
static1
Behavioral task
behavioral1
Sample
dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe
Resource
win10-20220901-en
General
-
Target
dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe
-
Size
332KB
-
MD5
d39b424ace8bcca3c76976f1be110845
-
SHA1
5a9f6d6cd10690ab24163916efe6e5282bacf292
-
SHA256
dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c
-
SHA512
0514027d7bbde93e386e5c3142a70619477fc046b9d823760c7921aff7a7479509f89a4a228850aa43f2c6004a33cd80762a45f46867ed292f4bbd9298b542c9
-
SSDEEP
6144:UklgdWNTdGCpZ9EmqSlMSJdo9vjIDcuT3ZVS:UkKwNVpZ9vqS3JOSDcudVS
Malware Config
Extracted
amadey
3.50
77.73.133.72/hfk3vK9/index.php
Extracted
redline
@2023
79.137.192.28:20723
-
auth_value
93b4b7d0dc8e9415e261a402587c6710
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 12 4928 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
gntuud.exesoftx64.exegntuud.exegntuud.exegntuud.exepid process 4600 gntuud.exe 5032 softx64.exe 2584 gntuud.exe 4184 gntuud.exe 3572 gntuud.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4928 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\softx64.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\softx64.exe" gntuud.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
softx64.exedescription pid process target process PID 5032 set thread context of 4812 5032 softx64.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4048 5032 WerFault.exe softx64.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
vbc.exerundll32.exepid process 4812 vbc.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe 4928 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 4812 vbc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exegntuud.exesoftx64.exedescription pid process target process PID 4760 wrote to memory of 4600 4760 dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe gntuud.exe PID 4760 wrote to memory of 4600 4760 dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe gntuud.exe PID 4760 wrote to memory of 4600 4760 dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe gntuud.exe PID 4600 wrote to memory of 3952 4600 gntuud.exe schtasks.exe PID 4600 wrote to memory of 3952 4600 gntuud.exe schtasks.exe PID 4600 wrote to memory of 3952 4600 gntuud.exe schtasks.exe PID 4600 wrote to memory of 5032 4600 gntuud.exe softx64.exe PID 4600 wrote to memory of 5032 4600 gntuud.exe softx64.exe PID 4600 wrote to memory of 5032 4600 gntuud.exe softx64.exe PID 5032 wrote to memory of 4812 5032 softx64.exe vbc.exe PID 5032 wrote to memory of 4812 5032 softx64.exe vbc.exe PID 5032 wrote to memory of 4812 5032 softx64.exe vbc.exe PID 5032 wrote to memory of 4812 5032 softx64.exe vbc.exe PID 5032 wrote to memory of 4812 5032 softx64.exe vbc.exe PID 4600 wrote to memory of 4928 4600 gntuud.exe rundll32.exe PID 4600 wrote to memory of 4928 4600 gntuud.exe rundll32.exe PID 4600 wrote to memory of 4928 4600 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe"C:\Users\Admin\AppData\Local\Temp\dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000014001\softx64.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\softx64.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 5284⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeC:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeC:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeC:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000014001\softx64.exeFilesize
277KB
MD575f4207637e56307389dfa82b3463690
SHA1d7d51072a59f78314e90327a9f5f74004ae8b2a7
SHA256c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b
SHA5121a634a4c84a6dd8304b15ad7e7e5010e347c21f9e9f23529f6f4945b00727df6084b1d7917977e1f4fed51b8fd3dc10f5dfa1627c756152a5c9c86089fe82b52
-
C:\Users\Admin\AppData\Local\Temp\1000014001\softx64.exeFilesize
277KB
MD575f4207637e56307389dfa82b3463690
SHA1d7d51072a59f78314e90327a9f5f74004ae8b2a7
SHA256c20188aeac3782469ac75c40911e5bae45d36f2208e286b51a5f6f5e878e371b
SHA5121a634a4c84a6dd8304b15ad7e7e5010e347c21f9e9f23529f6f4945b00727df6084b1d7917977e1f4fed51b8fd3dc10f5dfa1627c756152a5c9c86089fe82b52
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
332KB
MD5d39b424ace8bcca3c76976f1be110845
SHA15a9f6d6cd10690ab24163916efe6e5282bacf292
SHA256dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c
SHA5120514027d7bbde93e386e5c3142a70619477fc046b9d823760c7921aff7a7479509f89a4a228850aa43f2c6004a33cd80762a45f46867ed292f4bbd9298b542c9
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
332KB
MD5d39b424ace8bcca3c76976f1be110845
SHA15a9f6d6cd10690ab24163916efe6e5282bacf292
SHA256dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c
SHA5120514027d7bbde93e386e5c3142a70619477fc046b9d823760c7921aff7a7479509f89a4a228850aa43f2c6004a33cd80762a45f46867ed292f4bbd9298b542c9
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
332KB
MD5d39b424ace8bcca3c76976f1be110845
SHA15a9f6d6cd10690ab24163916efe6e5282bacf292
SHA256dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c
SHA5120514027d7bbde93e386e5c3142a70619477fc046b9d823760c7921aff7a7479509f89a4a228850aa43f2c6004a33cd80762a45f46867ed292f4bbd9298b542c9
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
332KB
MD5d39b424ace8bcca3c76976f1be110845
SHA15a9f6d6cd10690ab24163916efe6e5282bacf292
SHA256dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c
SHA5120514027d7bbde93e386e5c3142a70619477fc046b9d823760c7921aff7a7479509f89a4a228850aa43f2c6004a33cd80762a45f46867ed292f4bbd9298b542c9
-
C:\Users\Admin\AppData\Local\Temp\ecaac49691\gntuud.exeFilesize
332KB
MD5d39b424ace8bcca3c76976f1be110845
SHA15a9f6d6cd10690ab24163916efe6e5282bacf292
SHA256dd0a0312e7659c011d98b9945019bf2b5a9b35e37777cdc1f1b11b1bfe77075c
SHA5120514027d7bbde93e386e5c3142a70619477fc046b9d823760c7921aff7a7479509f89a4a228850aa43f2c6004a33cd80762a45f46867ed292f4bbd9298b542c9
-
C:\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dllFilesize
126KB
MD5349b2b47fef50fa6a1fc19d0ee4b2db8
SHA1077f4328b3f060a9f010b1a63d9e127d24ddafd4
SHA2565cd41f164de6f783b7da82b5f6dbd49413eccd87cc7470f2004d58ca081fb0e0
SHA51283fd58be4c0051ed05b7a03443d256d52f09206d2f433bd302c9e9e3780b9d472e823aed1db01b5052dc8fdc63a4352beac9e399858a8252c057f11cf2bd1773
-
\Users\Admin\AppData\Roaming\f49dfc5e4e2508\cred64.dllFilesize
126KB
MD5349b2b47fef50fa6a1fc19d0ee4b2db8
SHA1077f4328b3f060a9f010b1a63d9e127d24ddafd4
SHA2565cd41f164de6f783b7da82b5f6dbd49413eccd87cc7470f2004d58ca081fb0e0
SHA51283fd58be4c0051ed05b7a03443d256d52f09206d2f433bd302c9e9e3780b9d472e823aed1db01b5052dc8fdc63a4352beac9e399858a8252c057f11cf2bd1773
-
memory/2584-433-0x000000000075C000-0x000000000077B000-memory.dmpFilesize
124KB
-
memory/2584-434-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/3572-678-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/3572-683-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/3952-225-0x0000000000000000-mapping.dmp
-
memory/4184-646-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/4600-206-0x00000000005D0000-0x000000000071A000-memory.dmpFilesize
1.3MB
-
memory/4600-180-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-375-0x00000000005D0000-0x000000000071A000-memory.dmpFilesize
1.3MB
-
memory/4600-175-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-207-0x0000000002070000-0x00000000020AE000-memory.dmpFilesize
248KB
-
memory/4600-191-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-192-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-171-0x0000000000000000-mapping.dmp
-
memory/4600-376-0x0000000002070000-0x00000000020AE000-memory.dmpFilesize
248KB
-
memory/4600-173-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-177-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-247-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/4600-182-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-183-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-189-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-185-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-188-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-187-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-186-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-184-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-377-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/4600-179-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-178-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4600-176-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-147-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-139-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-162-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-163-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-164-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-165-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-166-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-167-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-168-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-169-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-170-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-160-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-159-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/4760-158-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-156-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-157-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-155-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-154-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-153-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-150-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/4760-151-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-152-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-148-0x0000000000550000-0x000000000069A000-memory.dmpFilesize
1.3MB
-
memory/4760-149-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-120-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-145-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-174-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/4760-146-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-144-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-143-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-142-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-140-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-141-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-161-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-138-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-137-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-136-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-122-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-134-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-121-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-123-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-125-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-124-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-126-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-127-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-128-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-133-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-132-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-131-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-130-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-129-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4812-356-0x000000000B640000-0x000000000B74A000-memory.dmpFilesize
1.0MB
-
memory/4812-363-0x00000000099F0000-0x0000000009A02000-memory.dmpFilesize
72KB
-
memory/4812-409-0x000000000C3D0000-0x000000000C592000-memory.dmpFilesize
1.8MB
-
memory/4812-417-0x000000000CFF0000-0x000000000D51C000-memory.dmpFilesize
5.2MB
-
memory/4812-393-0x000000000BF50000-0x000000000BFB6000-memory.dmpFilesize
408KB
-
memory/4812-367-0x0000000009A90000-0x0000000009ADB000-memory.dmpFilesize
300KB
-
memory/4812-403-0x000000000C160000-0x000000000C1F2000-memory.dmpFilesize
584KB
-
memory/4812-293-0x000000000041B5D2-mapping.dmp
-
memory/4812-353-0x0000000009DE0000-0x000000000A3E6000-memory.dmpFilesize
6.0MB
-
memory/4812-400-0x000000000C5C0000-0x000000000CABE000-memory.dmpFilesize
5.0MB
-
memory/4812-365-0x0000000009A50000-0x0000000009A8E000-memory.dmpFilesize
248KB
-
memory/4812-329-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4928-528-0x0000000000000000-mapping.dmp
-
memory/5032-254-0x0000000000000000-mapping.dmp