Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2024, 23:30

General

  • Target

    68e9767a80e49cdbca8e6d8cb26867aa.exe

  • Size

    3.9MB

  • MD5

    68e9767a80e49cdbca8e6d8cb26867aa

  • SHA1

    b6125fdec846e62cde9d65b6af224d9495cd190d

  • SHA256

    f91fa2953c6f7d35429a38ff474e1345da76a29c7a90c1c9b9380d9b09d8eead

  • SHA512

    510f4a2d309a3fdbcf40e4652b7ad5402a57fd11bd03a4966fb66c0ecf6ce49c93680d49a18afa99cc31871ac0381ccb64bc39d912f2c16d7f43161042cf7220

  • SSDEEP

    98304:fnsmtk2aqEIPmLgtC47Ik66NWtZdtzJ9RLkC3COU:vLG8mcA+IJpDV3M

Malware Config

Extracted

Family

darkcomet

Botnet

Main

C2

whp.sytes.net:1157

Mutex

DC_MUTEX-Z0KBHP5

Attributes
  • InstallPath

    MSDCSC\main.exe

  • gencode

    6SFPopLHSquT

  • install

    true

  • offline_keylogger

    true

  • password

    123

  • persistence

    true

  • reg_key

    main

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68e9767a80e49cdbca8e6d8cb26867aa.exe
    "C:\Users\Admin\AppData\Local\Temp\68e9767a80e49cdbca8e6d8cb26867aa.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE
        "C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"
        3⤵
        • Executes dropped EXE
        PID:860
      • C:\Users\Admin\Documents\MSDCSC\main.exe
        "C:\Users\Admin\Documents\MSDCSC\main.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:536
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            5⤵
              PID:1096
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          3⤵
          • Modifies WinLogon for persistence
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE
            "C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"
            4⤵
            • Executes dropped EXE
            PID:580
          • C:\Users\Admin\Documents\MSDCSC\main.exe
            "C:\Users\Admin\Documents\MSDCSC\main.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:2500

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            2.6MB

            MD5

            c20232f07e982da1550deaee45533d7d

            SHA1

            1cf678f200e473b8fa83c1c8644f71779e61f9bf

            SHA256

            50965fb146fc424bfaaccf076b510ad30dd401015a60d85a8e0377735735aa7d

            SHA512

            d318bcf1fd6406995e98b43390e589fa75c06f5657cfd5e074d2f9afc5ba1bb002d689124b37092a77239303dda684e0821bfdafd2116dad291e8995feaae532

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            2.1MB

            MD5

            7d0fc7bd97229713c4a3c9e962f57c56

            SHA1

            d7e529a936361f0e14b6c9822fea1b6fcfe096fd

            SHA256

            d4469b7f98b21dba49be9ca19ea8afed0a2048b27c0f004d6ecd182f380c6cde

            SHA512

            6bcd4ddaf020d06ce489b06d4ed82b5c9f18d2c7edc07c1eac310199199303db14456d6806fa11f7480f3a1d54e2861c71e32ee43eaa8b54ed7f3763f46ce05d

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            3.9MB

            MD5

            68e9767a80e49cdbca8e6d8cb26867aa

            SHA1

            b6125fdec846e62cde9d65b6af224d9495cd190d

            SHA256

            f91fa2953c6f7d35429a38ff474e1345da76a29c7a90c1c9b9380d9b09d8eead

            SHA512

            510f4a2d309a3fdbcf40e4652b7ad5402a57fd11bd03a4966fb66c0ecf6ce49c93680d49a18afa99cc31871ac0381ccb64bc39d912f2c16d7f43161042cf7220

          • C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe

            Filesize

            2.1MB

            MD5

            d594daf93080a00e040d705c1c78c5dd

            SHA1

            16d488e4bf69441e89ce38b88657ff333560ea45

            SHA256

            6d5e0e661fa8abf437ffcbd883b76a75eb3f8ba245af5dc5eb39539c3798dda7

            SHA512

            fc711cf0248e1cb997e3e6e00cbbfd7cb5a86efeb3308907a7dbea4184736b99ef90a89038b88313ff9b2617cf9585218b32e10d447ef5cd0656e730d27a76b7

          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

            Filesize

            1.4MB

            MD5

            8912620694ec1beeb7acc27cc2e8ce39

            SHA1

            78e4ad8366afe9ddf315c223e09600378db9c5bd

            SHA256

            2a8f062660e0b392fd2654f27c5324ed1b503135baf9238569ac5694236af4ee

            SHA512

            8759b5c374eae372c4eac0d62016ed4a0ff109d36b5032f2ec1ce30ebcbf075e1e0794deb2938f71149375bc37dfc329c93170b1fc5f3df315b28169d7e378fb

          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

            Filesize

            1.2MB

            MD5

            fcdbdc888e2a47c2fba1eeacc939ca8c

            SHA1

            242e43d37c87804bd89f53ae392a8539564ddc83

            SHA256

            43f7f1beca14031a08fa255720c5e051321e1f0d263a05bd3f3073916002ba3b

            SHA512

            d42b26eda2c731945502d527deb51210ec41b9643619d3f925d557ddf09e7277fd7f313341660947a9bd53a80623b40253c92912b1026bff8304cf80bda14ad1

          • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            1.9MB

            MD5

            0b93507475b24d11d7844837f55db512

            SHA1

            9f42a6c78c5fd5d1d6e5c0132e1a5408a354c46f

            SHA256

            29a94b8d47d6180575dc57be51e7fd68a1bf8b181bc7b4a2efdcdc1cb0588830

            SHA512

            0c2124e8dfb6f05f1c2aa2ff7cc3cef3434c243379277927d06211424dcec813e7d9afa2317efc0d3341d45222b0c33acad545580df9b7ac4c7bf965d9deb0e2

          • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            640KB

            MD5

            8651f8ad64fb786a11db7076c7c3dce0

            SHA1

            7efdba6f0eb41452528fa543a89e4a8ac910b1c6

            SHA256

            5bb9e200747c45f54a9ea47c630ada69f65480bcabc6aa98b2028b403bdaef53

            SHA512

            8aa6c2ef95297f70b40b701dcd059a937b872ea76ecfd8dd5e1dfb9581bcad3b23b19525993708a0363aa50c8bc9ca3618228b25556381026f9d93b4f9389a7b

          • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            1.4MB

            MD5

            79c6a4894283d3925ccb74b3168b5fd2

            SHA1

            196c0d71ab7439d58127afd8634ffee29275597b

            SHA256

            2ca817ae6d29f1170c72a9363fe1fb9337b749d95cca5982aa098c07cebeb284

            SHA512

            4153a6cf226d7dd366fa9ffc7de01a885a34fcd5a51c02b11e7c144f3073de834ffc13ae32240f1dd577407b4566cbd7435b9ada3061ea3990dc95d80f8ff7eb

          • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            896KB

            MD5

            f4d2cfb5b87e98146adec783a48716a8

            SHA1

            20b08e09acda0501a3c427d8413d837114859ca7

            SHA256

            fe15cf1a319583071013e07a412eaa43f5ecfb6a6b93a4f4aeb9e8d2f3555405

            SHA512

            4159cd20d5d901e22fac628e8da4b3d3481898aa586526d221d7f743125fb0a9d05e416e98898d41e6343a60de32c2136a4ba314c775d531be17e0c178ec4d74

          • C:\Users\Admin\Documents\MSDCSC\main.exe

            Filesize

            1.7MB

            MD5

            6a413037fc2b1de7912f13ec2a4d046f

            SHA1

            6bf51b46dce10ae548130e994ae946b64c8fa5c0

            SHA256

            d01d51179abbbacc10600684e874d38cfef0bc04a91e3cccae4a0c91dfff2c89

            SHA512

            7c89e054f7a63972364685a3cbce98703ec52cfcfb8005a4dca5d19ed7c3f056b374ac68596221ac970f53fbc6f4b1b4db8633d07de79f3ed7207db259981742

          • C:\Users\Admin\Documents\MSDCSC\main.exe

            Filesize

            256KB

            MD5

            fdca23190241667981a746051a66ef58

            SHA1

            2e63abb29719ee2caed1adc5a8e81179dd66e3e1

            SHA256

            e6de2aad745d94d1408c68240effa10ec06b258daa6d0801a5ff5a79fc9762ce

            SHA512

            488a20cb79a887b902d03abe6afab1590242fdaa9c38a4f20e50e3ae1f35298c537e304d26a100de6344bfbea1d00eee2a26ccd4f6f26aec1716b50dd17341bd

          • \ProgramData\Synaptics\Synaptics.exe

            Filesize

            3.3MB

            MD5

            413268aaed96490ef3a7dd1ac3e76095

            SHA1

            2c251af1d00e64683af7c798b9e3149e856b67a9

            SHA256

            31484bd33380e7b5fbb47cd38ce94dec8074b7d815d21a767fdd29f8d426305e

            SHA512

            13ec0b2c8c05a2bed26c3e5f3284e282508567c74ae895d1eeccbbf2c55089398292b60d429ce5ac4e7aa7ad6a3e7044598463e2d6c21061c05b0f857ec26008

          • \ProgramData\Synaptics\Synaptics.exe

            Filesize

            3.0MB

            MD5

            88bbb2eab7fe13c118d08f44c4750379

            SHA1

            b0755cb88fe4fa81cbd3bc45b4b5530549760293

            SHA256

            b5c26a209ee62d36f37eb6e387100fa72b39923556d49be2d91fca85e6795b06

            SHA512

            de768f7b15df8ac836a7b1c0531041121228d2946838d9a40704ec1e7dfe648eb252ba38ead59b1d704985250a5b276f3b90613f0e75b48ba1fa7bb767cd55b7

          • \ProgramData\Synaptics\Synaptics.exe

            Filesize

            3.6MB

            MD5

            d14e1534ba4d2b73467f5339e27f247f

            SHA1

            9b044e8b544c8b315244fa1489f045e226e56a3f

            SHA256

            e37168d09980d6235e679968f9d5e9a7c3e5140f1c5571bce28471ba259d234d

            SHA512

            f1707d97e1bfd1013808538e8bbc89b802c65e01ba3bddab3580cc1d900e888148fc810c5c97c7e6267eb7ac9ffef3b5fc7557cb0598077299c35e8919e42c88

          • \Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe

            Filesize

            3.2MB

            MD5

            adf43260a99ad4ad02f71dc4bb4a6fb4

            SHA1

            c913da7b00ec6c73e29c4bd26ca46a07af531a60

            SHA256

            b0dea29e2862732605642902983b4f6f067937b7335fa09a4ecb8c81222d61df

            SHA512

            8ec38afa0787fc9dbf5964bab7fe3975387c15ad29a5c7e4ada51872a9e10c2b9992c6bafa866ee9a8406775f40912f1e27e27bfebf7ae3574798d5503169acb

          • \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

            Filesize

            2.5MB

            MD5

            60c6bc223bf367d058cee3599410015a

            SHA1

            abcc359bf749877b6b2aa8496f740c2f40da10a9

            SHA256

            da6ef579db04639d7732e5bca2799d4558796e162d497c47fbb7f32cca89a924

            SHA512

            cf2f91104a68ba9910c0c575d62b0f32735d11c2fb46d13f2213720c065cfa87562fb54eae7e7c541060b23af980dd5ad203c15fd342b5651a34bc882370474f

          • \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

            Filesize

            1.1MB

            MD5

            4bf6a6f7a04286ab3fb18582fcd8a96d

            SHA1

            36780cbc76d1ca2d9ccb4ddcde87f7d2e40529d3

            SHA256

            eef109a0f7ea1ce54933fb66e763dc8e9980ce4b823ea4b1e32ac4f10b4806cc

            SHA512

            09dda82289816d5a4a7d120fc2e923b28293b70f436ed080e53f8aa80b8453218a38f7d1179c9081edc554547fbf418f37fed6b5f209312233c74b685277ae28

          • \Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            3.1MB

            MD5

            a88dc7e09b9f0bf848f573876330fa82

            SHA1

            1768fec9a20d15eb9928b8bc509c27ee489035b0

            SHA256

            508df82e23ec52765d98e2c02e6a0268b6c2aaf11aca8a3539e25156b86491bd

            SHA512

            c775b2bf8c5726ecea06223f00a79b2b826a7d0f1fc7901e04ad5749004449ea8f3fc55183189767e521590bfdeb40416bf5c196e0b00f70092ef5942c34eabe

          • \Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            1.3MB

            MD5

            bf67ef380ad9b149254d40391e48fc1e

            SHA1

            cb1afc3745e451f82626c66b21ead9565c6df172

            SHA256

            819d032ad83c14788ccd9b3bd264d1aad0f2ad47531acffc0069a851d9fecd4d

            SHA512

            ed0f1cc0376f809b00f507592b3bbc1e217b24f33ffffbfeac341354a6e7504c685724c83b220b89f5ccba9752f751ccf63fc57b5c97ee844df86d7d9daeeead

          • \Users\Admin\AppData\Local\Temp\MAIN.EXE

            Filesize

            1.2MB

            MD5

            b624f14f06b542e18c3fc019570a8e49

            SHA1

            525b60df4383e5dda20137f9066ffb5b0ead9032

            SHA256

            6118b65fee353766a0bae8c11deed55568cc13269eb975acbe1f2d2069275b3f

            SHA512

            2c236a3cfde62799ae2afb2802295a0e155015c5bad7ba9e5f336b338cb855a614d75afc43fe9df5d4ffab858935855121c62d2fc635bbc1cafbfc9d879e90ed

          • \Users\Admin\Documents\MSDCSC\main.exe

            Filesize

            1.9MB

            MD5

            a15c661358ba7256b2cd4ada427c55db

            SHA1

            3fc2fc27dfd14d89e526765fda10c5f656603d97

            SHA256

            fa922077ad8bae4b16616a134f43427a9731fe0009f0dc9c40ff08d0443460f0

            SHA512

            4000eba1f7fda9b047a6f840782064f7227aafc29af0b43aad4d661618a873985e497a4280e968b4fd15524f7b5aff4c6d3925ff1f13b1a28ff3e93fa9eb042a

          • \Users\Admin\Documents\MSDCSC\main.exe

            Filesize

            512KB

            MD5

            45497da2fcda9ca1ef9b493fd6b85307

            SHA1

            495e21ff9210dde23f318f9e36fd7ad4222f977d

            SHA256

            a9cf508e72fe053ee6a70404f343ea6e00839ef3206895e67097c0b3a64bd41e

            SHA512

            89e8409d7e9419e1c7a109af4819c439d86a0463cf59e10f1a53179bc927b7274892daad017f4924d84e94300ec9f9cc74fa9f11c74f6730810a0d0d6821b766

          • memory/536-99-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/1096-130-0x0000000000080000-0x0000000000081000-memory.dmp

            Filesize

            4KB

          • memory/1096-165-0x0000000000920000-0x0000000000921000-memory.dmp

            Filesize

            4KB

          • memory/1932-108-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/1932-95-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2500-129-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2500-166-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2500-167-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2624-116-0x0000000004B80000-0x0000000004B81000-memory.dmp

            Filesize

            4KB

          • memory/2624-100-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

            Filesize

            4KB

          • memory/2624-128-0x00000000057C0000-0x0000000005FD9000-memory.dmp

            Filesize

            8.1MB

          • memory/2624-127-0x0000000004B70000-0x0000000004B71000-memory.dmp

            Filesize

            4KB

          • memory/2624-126-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2624-125-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

            Filesize

            4KB

          • memory/2624-124-0x0000000004B50000-0x0000000004B51000-memory.dmp

            Filesize

            4KB

          • memory/2624-121-0x0000000004B20000-0x0000000004B21000-memory.dmp

            Filesize

            4KB

          • memory/2624-122-0x0000000004B60000-0x0000000004B61000-memory.dmp

            Filesize

            4KB

          • memory/2624-123-0x0000000000380000-0x0000000000381000-memory.dmp

            Filesize

            4KB

          • memory/2624-119-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

            Filesize

            4KB

          • memory/2624-120-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

            Filesize

            4KB

          • memory/2624-117-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

            Filesize

            4KB

          • memory/2624-118-0x0000000004B10000-0x0000000004B11000-memory.dmp

            Filesize

            4KB

          • memory/2624-111-0x0000000004A80000-0x0000000004A81000-memory.dmp

            Filesize

            4KB

          • memory/2624-114-0x0000000004C40000-0x0000000004C41000-memory.dmp

            Filesize

            4KB

          • memory/2624-115-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

            Filesize

            4KB

          • memory/2624-110-0x0000000004A90000-0x0000000004A92000-memory.dmp

            Filesize

            8KB

          • memory/2624-98-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2624-48-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2624-107-0x0000000004610000-0x0000000004611000-memory.dmp

            Filesize

            4KB

          • memory/2764-88-0x0000000005790000-0x0000000005FA9000-memory.dmp

            Filesize

            8.1MB

          • memory/2764-68-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

            Filesize

            4KB

          • memory/2764-54-0x00000000049D0000-0x00000000049D1000-memory.dmp

            Filesize

            4KB

          • memory/2764-55-0x0000000004510000-0x0000000004511000-memory.dmp

            Filesize

            4KB

          • memory/2764-53-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2764-90-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2764-56-0x0000000004530000-0x0000000004532000-memory.dmp

            Filesize

            8KB

          • memory/2764-21-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2764-65-0x0000000004540000-0x0000000004541000-memory.dmp

            Filesize

            4KB

          • memory/2764-59-0x0000000004C40000-0x0000000004C41000-memory.dmp

            Filesize

            4KB

          • memory/2764-89-0x0000000005790000-0x0000000005FA9000-memory.dmp

            Filesize

            8.1MB

          • memory/2764-66-0x0000000004E60000-0x0000000004E62000-memory.dmp

            Filesize

            8KB

          • memory/2764-35-0x00000000779F0000-0x00000000779F2000-memory.dmp

            Filesize

            8KB

          • memory/2764-87-0x0000000000400000-0x0000000000C19000-memory.dmp

            Filesize

            8.1MB

          • memory/2764-67-0x0000000004B00000-0x0000000004B01000-memory.dmp

            Filesize

            4KB

          • memory/2764-58-0x0000000004520000-0x0000000004521000-memory.dmp

            Filesize

            4KB

          • memory/2764-60-0x0000000004B60000-0x0000000004B61000-memory.dmp

            Filesize

            4KB

          • memory/2764-61-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

            Filesize

            4KB

          • memory/2764-62-0x0000000004B70000-0x0000000004B71000-memory.dmp

            Filesize

            4KB

          • memory/2764-69-0x0000000004B10000-0x0000000004B11000-memory.dmp

            Filesize

            4KB

          • memory/2764-71-0x00000000003E0000-0x00000000003E1000-memory.dmp

            Filesize

            4KB

          • memory/2764-72-0x0000000004B40000-0x0000000004B41000-memory.dmp

            Filesize

            4KB

          • memory/2764-73-0x0000000004D90000-0x0000000004D91000-memory.dmp

            Filesize

            4KB

          • memory/2764-70-0x0000000004B50000-0x0000000004B51000-memory.dmp

            Filesize

            4KB

          • memory/2832-164-0x0000000000400000-0x00000000007F6000-memory.dmp

            Filesize

            4.0MB

          • memory/2832-46-0x0000000005290000-0x0000000005AA9000-memory.dmp

            Filesize

            8.1MB

          • memory/2832-32-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2832-97-0x0000000000400000-0x00000000007F6000-memory.dmp

            Filesize

            4.0MB

          • memory/2832-47-0x0000000005290000-0x0000000005AA9000-memory.dmp

            Filesize

            8.1MB

          • memory/2832-168-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2832-169-0x0000000005290000-0x0000000005AA9000-memory.dmp

            Filesize

            8.1MB

          • memory/2832-170-0x0000000005290000-0x0000000005AA9000-memory.dmp

            Filesize

            8.1MB

          • memory/2832-204-0x0000000000400000-0x00000000007F6000-memory.dmp

            Filesize

            4.0MB

          • memory/3048-0-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/3048-30-0x0000000000400000-0x00000000007F6000-memory.dmp

            Filesize

            4.0MB

          • memory/3048-22-0x0000000005250000-0x0000000005A69000-memory.dmp

            Filesize

            8.1MB

          • memory/3048-19-0x0000000005250000-0x0000000005A69000-memory.dmp

            Filesize

            8.1MB