Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 23:30

General

  • Target

    68e9767a80e49cdbca8e6d8cb26867aa.exe

  • Size

    3.9MB

  • MD5

    68e9767a80e49cdbca8e6d8cb26867aa

  • SHA1

    b6125fdec846e62cde9d65b6af224d9495cd190d

  • SHA256

    f91fa2953c6f7d35429a38ff474e1345da76a29c7a90c1c9b9380d9b09d8eead

  • SHA512

    510f4a2d309a3fdbcf40e4652b7ad5402a57fd11bd03a4966fb66c0ecf6ce49c93680d49a18afa99cc31871ac0381ccb64bc39d912f2c16d7f43161042cf7220

  • SSDEEP

    98304:fnsmtk2aqEIPmLgtC47Ik66NWtZdtzJ9RLkC3COU:vLG8mcA+IJpDV3M

Malware Config

Extracted

Family

darkcomet

Botnet

Main

C2

whp.sytes.net:1157

Mutex

DC_MUTEX-Z0KBHP5

Attributes
  • InstallPath

    MSDCSC\main.exe

  • gencode

    6SFPopLHSquT

  • install

    true

  • offline_keylogger

    true

  • password

    123

  • persistence

    true

  • reg_key

    main

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68e9767a80e49cdbca8e6d8cb26867aa.exe
    "C:\Users\Admin\AppData\Local\Temp\68e9767a80e49cdbca8e6d8cb26867aa.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE
        "C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"
        3⤵
        • Executes dropped EXE
        PID:2616
      • C:\Users\Admin\Documents\MSDCSC\main.exe
        "C:\Users\Admin\Documents\MSDCSC\main.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:456
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:316
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            4⤵
              PID:1612
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
              4⤵
                PID:2252
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3848
            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
              3⤵
              • Modifies WinLogon for persistence
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4120
              • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE
                "C:\Users\Admin\AppData\Local\Temp\MAIN.EXE"
                4⤵
                • Executes dropped EXE
                PID:1020
              • C:\Users\Admin\Documents\MSDCSC\main.exe
                "C:\Users\Admin\Documents\MSDCSC\main.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:5076
        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
          1⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:4924

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Synaptics\Synaptics.exe

                Filesize

                68KB

                MD5

                fd62b0384996c724274436a14eb2014a

                SHA1

                50013197b3565e778e0d0e3bb267f2bf18cba10b

                SHA256

                42487ee73087367b001278541879efbcfdc7118a84fccab05441cdb7d7901858

                SHA512

                7203b85858e697dc6ebb4634f5f67cbb25317796e45a5ba51ff53e3f40db7061e9509d049914c7d98033ad5ee16ef423642b39d98870920081db2c58bd356863

              • C:\ProgramData\Synaptics\Synaptics.exe

                Filesize

                35KB

                MD5

                abbe4634d9a892d56ca7d3a94b38caba

                SHA1

                5f471e405f8a44b5e5c8667eed8fd275f77d0900

                SHA256

                e0da48deee7d7b2fbd030ce197ea85a7ccf4f7f937604e017b50407d602a5a31

                SHA512

                b5046dcae7045b09aa146c2815e3445ec93575b20acde146cdcea338841c00ada64489e4fd6a61dd41d72aa7aced70af65b2d578f220bd2ee9b96e22835156e6

              • C:\ProgramData\Synaptics\Synaptics.exe

                Filesize

                346KB

                MD5

                afe8e5457ffdba7fd71be9790d76a820

                SHA1

                b0618fa870c6103442619b1bf566de43d5c6a4b0

                SHA256

                57ce4d76c4ef09b47c69fdc8573f8a92dd394eb2d4466f6399a850d5aea9c851

                SHA512

                e8ef6bb158396fcd4e23b2988456440f600382cbe9861e33cf88d44e1ad45c823498268caf62e89709b31ca8f31e5817d36c3fae052023d92a4664a758f5725c

              • C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe

                Filesize

                3.2MB

                MD5

                adf43260a99ad4ad02f71dc4bb4a6fb4

                SHA1

                c913da7b00ec6c73e29c4bd26ca46a07af531a60

                SHA256

                b0dea29e2862732605642902983b4f6f067937b7335fa09a4ecb8c81222d61df

                SHA512

                8ec38afa0787fc9dbf5964bab7fe3975387c15ad29a5c7e4ada51872a9e10c2b9992c6bafa866ee9a8406775f40912f1e27e27bfebf7ae3574798d5503169acb

              • C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe

                Filesize

                721KB

                MD5

                739d8ce16d7a529d26e5b64597094eea

                SHA1

                479ff6dad45d938ef5378ec6eb09405f20d63f8b

                SHA256

                677d6f54f4f33592b8a395caa9e41d024ff7470c3122c468ea7181e0ebd3cabc

                SHA512

                f65858dec3747fc559afc6971a820741c2799134657e022959f692a2f4324872cbedf0104f91fbf60f8fd2ca561c5f119e0560f8f370a2871721e80c8d025f75

              • C:\Users\Admin\AppData\Local\Temp\._cache_68e9767a80e49cdbca8e6d8cb26867aa.exe

                Filesize

                498KB

                MD5

                29f7dec13017a0500b293803fd6566cb

                SHA1

                dd68bcbcf7119da919dd7a0099124ba843d24d86

                SHA256

                31775efea945ba1d7b2456365f6404a99fc9675b9eb57121f051a7cd05ff4185

                SHA512

                c441e5750ee3dccef30fc1b20e57895a27975fe729deda2731e5968493e65226258f82f52ddb0617237e500596a1d2da85716c9503bdee4de65e5d181f001571

              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

                Filesize

                456KB

                MD5

                c1ea12304ef7577300d15fb160993d5a

                SHA1

                4cdf4162e2ad3dafab1f77492ee03b5987d60874

                SHA256

                2bafa92794aa41de575c8bed50dd58a575be60f9fe379279776777c576a648d5

                SHA512

                f438fc91cf1526681156b3fb5dcb664942db829c22fe4e6926a6d92a9c3e7bdf6406cdfcd6abac060a2e9d57047e54ac223f29b3855bb1255b3f42baff7cc166

              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

                Filesize

                758KB

                MD5

                a3e88f99627a815228015311e7936c8c

                SHA1

                3c953bf628b9f7dd8a225183eca3e100918666bb

                SHA256

                02b068912be3a6791d205e740db1d23b65d9962a49dc4ee08a5ef292c2869b72

                SHA512

                32fe948fe92baf17ab1966841863a203ae9b684cf282440d0a094097d6d418d780ca8a1c65b00fe1fddb80ec21e4374b9d4c85336cd5adc968cab4b50135dd90

              • C:\Users\Admin\AppData\Local\Temp\I95WSgqb.xlsm

                Filesize

                17KB

                MD5

                e566fc53051035e1e6fd0ed1823de0f9

                SHA1

                00bc96c48b98676ecd67e81a6f1d7754e4156044

                SHA256

                8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                SHA512

                a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

              • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

                Filesize

                803KB

                MD5

                2a6ead88f1f1565757db18c979382c91

                SHA1

                74e7b50e614e77c74f10c3998f955573326ed0c0

                SHA256

                fb9be7092ed298f531d49f3042c5594ff08d5db2f636a20dedefe795e260ddff

                SHA512

                8218786b07e3ea3f98aa90a4c63ba8278acd56a130696bc7e67c45deba23c78479fcb0cfe82cfad82cc53f4005965dc160a68b9be5f01ae112ba5fb41160228b

              • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

                Filesize

                82KB

                MD5

                62daab2ece893c95ab28780f7a398e32

                SHA1

                3ace80e06dab248783dc5c37e77e78ab866c1541

                SHA256

                ab68ac8d079e0b172e9648113b97f8d4daec7de9b19d82eb2c0c3330af9ccaf1

                SHA512

                db09ddff42c07bf290a710aee0dd4e2f5bbc5e0be84394598679840fdf2984d0e2d4dc154d675756095bae5fec9f379f7e315c2e0468fca74966e6aae8cea2b6

              • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

                Filesize

                172KB

                MD5

                4a27c90a68489f3ae6bf018dca18a61d

                SHA1

                f1d242f6c3077d46f56ec716b9b44be3c05ab58d

                SHA256

                4c76da09caab4640dd3960fd1b67afb32361a199e97a0f1b56d8ae11d8b12827

                SHA512

                c6b13d26444a55c70e25543ab20beed1b2bad957f8cff8bfe3986d8802c895433f39bba44155649a9e642742462abdef94483f1794cda18e4e17497c679fd120

              • C:\Users\Admin\AppData\Local\Temp\MAIN.EXE

                Filesize

                57KB

                MD5

                369ef80d2852218edff9c20ae3e2f03f

                SHA1

                80fda0d08a6d78a0f3e2919e5d53e2f177aa9382

                SHA256

                511f7a9f74832f33597b44c1c226dcf9ce663e19d0a8fad03a606360ac446b64

                SHA512

                6670cee9ce74fee456b443953859c39a4f96a9cbe4eec423fb87bd76e21cef34961bd9ecc570390ae096bcffee8e167c3d506de4138fd071e41156536c5b5317

              • C:\Users\Admin\Documents\MSDCSC\main.exe

                Filesize

                525KB

                MD5

                752bf0e6a7036444112523431fb1a818

                SHA1

                494c0be8082f37403e9aa99c25e245cdf90631bd

                SHA256

                5ed6d61ca696af95ea6f1b0ff54b576fa664b178582366caaa53c3b8342cbf91

                SHA512

                df22de217a8d0a2f66af9ae0aed297f5c93f9a8804e888bb012f0ddf1fec8d611da807dd7927abf835084f01f44c8b282763ad770bc6ba87624902f3b774a6d5

              • C:\Users\Admin\Documents\MSDCSC\main.exe

                Filesize

                25KB

                MD5

                9921bdf03e25219e6e8cab4ab97ef00d

                SHA1

                297d75d5aea9a968119471e625a17714fb87dc8d

                SHA256

                aa7e3b7cda06a37a32c51d85798a03cac4997f01e945fc237dc76150906b565d

                SHA512

                41a95ffe2c5d0b9294ec541a57c34bafc62e1b840d0a68fc4e1178f8f51e29af5d3ca197a11ad6bd5c4dbff82a40e1dd7280184a9d76c0c523bbeff6ed66af10

              • C:\Users\Admin\Documents\MSDCSC\main.exe

                Filesize

                401KB

                MD5

                bca99288d93b3a82f3796d17547f9f69

                SHA1

                1b0d8f740844d8a7fb1d0b6130d7347b78a08fd5

                SHA256

                f4351496d8f5f242985e5936db667159f03de0addc44ce2142ee7e4ccca395a5

                SHA512

                182871bc95365709002fc1417ac9adfe7d1b5d0693f9f85654238feca17e6c41f50e27da2006f2e2d456003544f2af0c0a88f0082157aa0cb82c9176de897654

              • memory/456-316-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-284-0x0000000005080000-0x0000000005081000-memory.dmp

                Filesize

                4KB

              • memory/456-326-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-324-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-322-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-319-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-352-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-275-0x0000000005070000-0x0000000005071000-memory.dmp

                Filesize

                4KB

              • memory/456-276-0x0000000005040000-0x0000000005041000-memory.dmp

                Filesize

                4KB

              • memory/456-278-0x0000000005050000-0x0000000005051000-memory.dmp

                Filesize

                4KB

              • memory/456-280-0x0000000005200000-0x0000000005201000-memory.dmp

                Filesize

                4KB

              • memory/456-281-0x0000000005170000-0x0000000005171000-memory.dmp

                Filesize

                4KB

              • memory/456-283-0x0000000005150000-0x0000000005151000-memory.dmp

                Filesize

                4KB

              • memory/456-330-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-285-0x00000000052E0000-0x00000000052E2000-memory.dmp

                Filesize

                8KB

              • memory/456-286-0x0000000005320000-0x0000000005321000-memory.dmp

                Filesize

                4KB

              • memory/456-287-0x00000000050C0000-0x00000000050C1000-memory.dmp

                Filesize

                4KB

              • memory/456-282-0x00000000050B0000-0x00000000050B1000-memory.dmp

                Filesize

                4KB

              • memory/456-277-0x0000000005060000-0x0000000005062000-memory.dmp

                Filesize

                8KB

              • memory/456-354-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-356-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-274-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-358-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-361-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-363-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-365-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-367-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/456-259-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/1156-205-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/1156-224-0x0000000005040000-0x0000000005041000-memory.dmp

                Filesize

                4KB

              • memory/1156-71-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/1156-230-0x0000000005070000-0x0000000005071000-memory.dmp

                Filesize

                4KB

              • memory/1156-232-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                Filesize

                4KB

              • memory/1156-233-0x00000000050A0000-0x00000000050A1000-memory.dmp

                Filesize

                4KB

              • memory/1156-200-0x00000000776F4000-0x00000000776F6000-memory.dmp

                Filesize

                8KB

              • memory/1156-218-0x0000000005110000-0x0000000005111000-memory.dmp

                Filesize

                4KB

              • memory/1156-255-0x00000000050D0000-0x00000000050D1000-memory.dmp

                Filesize

                4KB

              • memory/1156-231-0x00000000050B0000-0x00000000050B1000-memory.dmp

                Filesize

                4KB

              • memory/1156-206-0x0000000005030000-0x0000000005031000-memory.dmp

                Filesize

                4KB

              • memory/1156-229-0x0000000005320000-0x0000000005321000-memory.dmp

                Filesize

                4KB

              • memory/1156-207-0x0000000005000000-0x0000000005001000-memory.dmp

                Filesize

                4KB

              • memory/1156-213-0x0000000005140000-0x0000000005141000-memory.dmp

                Filesize

                4KB

              • memory/1156-212-0x0000000005010000-0x0000000005011000-memory.dmp

                Filesize

                4KB

              • memory/1156-215-0x0000000005150000-0x0000000005151000-memory.dmp

                Filesize

                4KB

              • memory/1156-214-0x0000000005060000-0x0000000005061000-memory.dmp

                Filesize

                4KB

              • memory/1156-208-0x0000000005020000-0x0000000005022000-memory.dmp

                Filesize

                8KB

              • memory/1156-267-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/1156-226-0x00000000052E0000-0x00000000052E2000-memory.dmp

                Filesize

                8KB

              • memory/1316-0-0x0000000002590000-0x0000000002591000-memory.dmp

                Filesize

                4KB

              • memory/1316-129-0x0000000000400000-0x00000000007F6000-memory.dmp

                Filesize

                4.0MB

              • memory/1612-279-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                Filesize

                4KB

              • memory/3848-272-0x0000000002460000-0x0000000002461000-memory.dmp

                Filesize

                4KB

              • memory/3848-312-0x0000000000400000-0x00000000007F6000-memory.dmp

                Filesize

                4.0MB

              • memory/3848-351-0x0000000000400000-0x00000000007F6000-memory.dmp

                Filesize

                4.0MB

              • memory/3848-130-0x0000000002460000-0x0000000002461000-memory.dmp

                Filesize

                4KB

              • memory/4120-242-0x00000000050D0000-0x00000000050D1000-memory.dmp

                Filesize

                4KB

              • memory/4120-244-0x0000000005140000-0x0000000005141000-memory.dmp

                Filesize

                4KB

              • memory/4120-269-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/4120-236-0x0000000005000000-0x0000000005001000-memory.dmp

                Filesize

                4KB

              • memory/4120-257-0x00000000050C0000-0x00000000050C1000-memory.dmp

                Filesize

                4KB

              • memory/4120-237-0x0000000005020000-0x0000000005022000-memory.dmp

                Filesize

                8KB

              • memory/4120-239-0x00000000051C0000-0x00000000051C1000-memory.dmp

                Filesize

                4KB

              • memory/4120-241-0x0000000005130000-0x0000000005131000-memory.dmp

                Filesize

                4KB

              • memory/4120-253-0x0000000004B40000-0x0000000004B41000-memory.dmp

                Filesize

                4KB

              • memory/4120-243-0x0000000005060000-0x0000000005061000-memory.dmp

                Filesize

                4KB

              • memory/4120-256-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/4120-254-0x00000000050A0000-0x00000000050A1000-memory.dmp

                Filesize

                4KB

              • memory/4120-238-0x0000000005010000-0x0000000005011000-memory.dmp

                Filesize

                4KB

              • memory/4120-246-0x0000000005110000-0x0000000005111000-memory.dmp

                Filesize

                4KB

              • memory/4120-247-0x0000000005040000-0x0000000005041000-memory.dmp

                Filesize

                4KB

              • memory/4120-252-0x00000000050B0000-0x00000000050B1000-memory.dmp

                Filesize

                4KB

              • memory/4120-248-0x00000000052B0000-0x00000000052B2000-memory.dmp

                Filesize

                8KB

              • memory/4120-234-0x0000000005030000-0x0000000005031000-memory.dmp

                Filesize

                4KB

              • memory/4120-191-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/4120-251-0x0000000005070000-0x0000000005071000-memory.dmp

                Filesize

                4KB

              • memory/4120-249-0x00000000052F0000-0x00000000052F1000-memory.dmp

                Filesize

                4KB

              • memory/4924-204-0x00007FFE9FC50000-0x00007FFE9FC60000-memory.dmp

                Filesize

                64KB

              • memory/4924-197-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

                Filesize

                2.0MB

              • memory/4924-201-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

                Filesize

                64KB

              • memory/4924-194-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

                Filesize

                64KB

              • memory/4924-199-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

                Filesize

                2.0MB

              • memory/4924-198-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

                Filesize

                64KB

              • memory/4924-196-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

                Filesize

                64KB

              • memory/4924-202-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

                Filesize

                2.0MB

              • memory/4924-195-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

                Filesize

                2.0MB

              • memory/4924-193-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

                Filesize

                2.0MB

              • memory/4924-192-0x00007FFEA1DD0000-0x00007FFEA1DE0000-memory.dmp

                Filesize

                64KB

              • memory/4924-203-0x00007FFE9FC50000-0x00007FFE9FC60000-memory.dmp

                Filesize

                64KB

              • memory/4924-273-0x00007FFEE1D50000-0x00007FFEE1F45000-memory.dmp

                Filesize

                2.0MB

              • memory/5076-293-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB

              • memory/5076-266-0x0000000000400000-0x0000000000C19000-memory.dmp

                Filesize

                8.1MB