Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 12:17
Behavioral task
behavioral1
Sample
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe
Resource
win7-20220812-en
General
-
Target
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe
-
Size
842KB
-
MD5
209358b1bb8353a5bc3aa31016147e61
-
SHA1
9032fa902bb5279270a64e89207543c77f3b8eb3
-
SHA256
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965
-
SHA512
a80fa8af67cebf271e6495b4baf1691266a05db8899ad3cd5d589aaa91f49bf66d1db653690477908012c01072a4abd94796cece1690a94c53fae2ad57f886a5
-
SSDEEP
12288:I9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hbwZAI:8Z1xuVVjfFoynPaVBUR8f+kN10EBCZAI
Malware Config
Extracted
darkcomet
Sazan
uysalimben.duckdns.org:25565
DC_MUTEX-QTEVKQM
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6imH2lmx94gX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1748 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2008 attrib.exe 2004 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1924 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exepid process 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\ 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeSecurityPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeTakeOwnershipPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeLoadDriverPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeSystemProfilePrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeSystemtimePrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeProfSingleProcessPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeIncBasePriorityPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeCreatePagefilePrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeBackupPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeRestorePrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeShutdownPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeDebugPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeSystemEnvironmentPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeChangeNotifyPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeRemoteShutdownPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeUndockPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeManageVolumePrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeImpersonatePrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeCreateGlobalPrivilege 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: 33 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: 34 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: 35 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe Token: SeIncreaseQuotaPrivilege 1748 msdcsc.exe Token: SeSecurityPrivilege 1748 msdcsc.exe Token: SeTakeOwnershipPrivilege 1748 msdcsc.exe Token: SeLoadDriverPrivilege 1748 msdcsc.exe Token: SeSystemProfilePrivilege 1748 msdcsc.exe Token: SeSystemtimePrivilege 1748 msdcsc.exe Token: SeProfSingleProcessPrivilege 1748 msdcsc.exe Token: SeIncBasePriorityPrivilege 1748 msdcsc.exe Token: SeCreatePagefilePrivilege 1748 msdcsc.exe Token: SeBackupPrivilege 1748 msdcsc.exe Token: SeRestorePrivilege 1748 msdcsc.exe Token: SeShutdownPrivilege 1748 msdcsc.exe Token: SeDebugPrivilege 1748 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1748 msdcsc.exe Token: SeChangeNotifyPrivilege 1748 msdcsc.exe Token: SeRemoteShutdownPrivilege 1748 msdcsc.exe Token: SeUndockPrivilege 1748 msdcsc.exe Token: SeManageVolumePrivilege 1748 msdcsc.exe Token: SeImpersonatePrivilege 1748 msdcsc.exe Token: SeCreateGlobalPrivilege 1748 msdcsc.exe Token: 33 1748 msdcsc.exe Token: 34 1748 msdcsc.exe Token: 35 1748 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1748 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.execmd.execmd.exemsdcsc.exedescription pid process target process PID 812 wrote to memory of 2036 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 2036 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 2036 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 2036 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 1104 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 1104 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 1104 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 1104 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe cmd.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 812 wrote to memory of 1924 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe notepad.exe PID 2036 wrote to memory of 2008 2036 cmd.exe attrib.exe PID 2036 wrote to memory of 2008 2036 cmd.exe attrib.exe PID 2036 wrote to memory of 2008 2036 cmd.exe attrib.exe PID 2036 wrote to memory of 2008 2036 cmd.exe attrib.exe PID 1104 wrote to memory of 2004 1104 cmd.exe attrib.exe PID 1104 wrote to memory of 2004 1104 cmd.exe attrib.exe PID 1104 wrote to memory of 2004 1104 cmd.exe attrib.exe PID 1104 wrote to memory of 2004 1104 cmd.exe attrib.exe PID 812 wrote to memory of 1748 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe msdcsc.exe PID 812 wrote to memory of 1748 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe msdcsc.exe PID 812 wrote to memory of 1748 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe msdcsc.exe PID 812 wrote to memory of 1748 812 75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe msdcsc.exe PID 1748 wrote to memory of 1004 1748 msdcsc.exe iexplore.exe PID 1748 wrote to memory of 1004 1748 msdcsc.exe iexplore.exe PID 1748 wrote to memory of 1004 1748 msdcsc.exe iexplore.exe PID 1748 wrote to memory of 1004 1748 msdcsc.exe iexplore.exe PID 1748 wrote to memory of 1720 1748 msdcsc.exe explorer.exe PID 1748 wrote to memory of 1720 1748 msdcsc.exe explorer.exe PID 1748 wrote to memory of 1720 1748 msdcsc.exe explorer.exe PID 1748 wrote to memory of 1720 1748 msdcsc.exe explorer.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe PID 1748 wrote to memory of 1812 1748 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2008 attrib.exe 2004 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe"C:\Users\Admin\AppData\Local\Temp\75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\75d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
842KB
MD5209358b1bb8353a5bc3aa31016147e61
SHA19032fa902bb5279270a64e89207543c77f3b8eb3
SHA25675d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965
SHA512a80fa8af67cebf271e6495b4baf1691266a05db8899ad3cd5d589aaa91f49bf66d1db653690477908012c01072a4abd94796cece1690a94c53fae2ad57f886a5
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
842KB
MD5209358b1bb8353a5bc3aa31016147e61
SHA19032fa902bb5279270a64e89207543c77f3b8eb3
SHA25675d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965
SHA512a80fa8af67cebf271e6495b4baf1691266a05db8899ad3cd5d589aaa91f49bf66d1db653690477908012c01072a4abd94796cece1690a94c53fae2ad57f886a5
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
842KB
MD5209358b1bb8353a5bc3aa31016147e61
SHA19032fa902bb5279270a64e89207543c77f3b8eb3
SHA25675d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965
SHA512a80fa8af67cebf271e6495b4baf1691266a05db8899ad3cd5d589aaa91f49bf66d1db653690477908012c01072a4abd94796cece1690a94c53fae2ad57f886a5
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
842KB
MD5209358b1bb8353a5bc3aa31016147e61
SHA19032fa902bb5279270a64e89207543c77f3b8eb3
SHA25675d51610bad46c1d3678d6efdbbedac4fdb0459d3ef8cb4e0d638d70b4561965
SHA512a80fa8af67cebf271e6495b4baf1691266a05db8899ad3cd5d589aaa91f49bf66d1db653690477908012c01072a4abd94796cece1690a94c53fae2ad57f886a5
-
memory/812-54-0x0000000075131000-0x0000000075133000-memory.dmpFilesize
8KB
-
memory/1104-56-0x0000000000000000-mapping.dmp
-
memory/1748-63-0x0000000000000000-mapping.dmp
-
memory/1812-67-0x0000000000000000-mapping.dmp
-
memory/1924-57-0x0000000000000000-mapping.dmp
-
memory/2004-60-0x0000000000000000-mapping.dmp
-
memory/2008-59-0x0000000000000000-mapping.dmp
-
memory/2036-55-0x0000000000000000-mapping.dmp