darkcomet | 684036adf28f3fd61de6309f04c081158f56daa810742ca01b1ff132dcddc579

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe
Size 1.5MB
Sample240718-b7htcszbpj
SHA256 684036adf28f3fd61de6309f04c081158f56daa810742ca01b1ff132dcddc579
MD5 55add9edfc6554324406ec3c3f6a28ba
SHA1 3caccd46b1ca4944f3b88f7aa241900b09c99818
SHA512 6ecb4eb04ab43b2d1827eefa221e25d07b925f7e719aa8c1b1170c1c2d27e1fb79a1b8a1334eb075a5c51161348c196ec51b14ccf7b3d1ebaa9ae81d1d86697c
SSDEEP 24576:sHowcKaJsy4JzFsef1K7ywjcFT3qgoFp5nM5MJGwy7XNBvVGht:sHXA+yaFsew7sFbqt75n/GwsXTVS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 mise a j evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

darkcomet2013.no-ip.biz:1500
192.168.1.71:1500

Mutex

DC_MUTEX-0CL16WC

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
afvedzjJwqrq
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Extracted

Family

darkcomet

Botnet

Mise a j

city972.no-ip.biz:1550

Mutex

DC_MUTEX-R6CBWTY

Attributes

gencode
mhm0aGqb433o
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	AppLaunch.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2712	attrib.exe
8	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	JUUU.EXE

Executes dropped EXE 4 IoCs

pid	Process
4036	JUUU.EXE
2704	PROTECTED.EXE
2484	VSCover.exe
2420	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\VSCover.exe"	VSCover.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	AppLaunch.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	AppLaunch.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 1236	2704	PROTECTED.EXE	88
PID 4036 set thread context of 3156	4036	JUUU.EXE	89

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4036	JUUU.EXE
4036	JUUU.EXE
2484	VSCover.exe
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE
4036	JUUU.EXE

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	PROTECTED.EXE
Token: SeDebugPrivilege	4036	JUUU.EXE
Token: SeIncreaseQuotaPrivilege	1236	AppLaunch.exe
Token: SeSecurityPrivilege	1236	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	1236	AppLaunch.exe
Token: SeLoadDriverPrivilege	1236	AppLaunch.exe
Token: SeSystemProfilePrivilege	1236	AppLaunch.exe
Token: SeSystemtimePrivilege	1236	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	1236	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	1236	AppLaunch.exe
Token: SeCreatePagefilePrivilege	1236	AppLaunch.exe
Token: SeBackupPrivilege	1236	AppLaunch.exe
Token: SeRestorePrivilege	1236	AppLaunch.exe
Token: SeShutdownPrivilege	1236	AppLaunch.exe
Token: SeDebugPrivilege	1236	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	1236	AppLaunch.exe
Token: SeChangeNotifyPrivilege	1236	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	1236	AppLaunch.exe
Token: SeUndockPrivilege	1236	AppLaunch.exe
Token: SeManageVolumePrivilege	1236	AppLaunch.exe
Token: SeImpersonatePrivilege	1236	AppLaunch.exe
Token: SeCreateGlobalPrivilege	1236	AppLaunch.exe
Token: 33	1236	AppLaunch.exe
Token: 34	1236	AppLaunch.exe
Token: 35	1236	AppLaunch.exe
Token: 36	1236	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	3156	AppLaunch.exe
Token: SeSecurityPrivilege	3156	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	3156	AppLaunch.exe
Token: SeLoadDriverPrivilege	3156	AppLaunch.exe
Token: SeSystemProfilePrivilege	3156	AppLaunch.exe
Token: SeSystemtimePrivilege	3156	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	3156	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	3156	AppLaunch.exe
Token: SeCreatePagefilePrivilege	3156	AppLaunch.exe
Token: SeBackupPrivilege	3156	AppLaunch.exe
Token: SeRestorePrivilege	3156	AppLaunch.exe
Token: SeShutdownPrivilege	3156	AppLaunch.exe
Token: SeDebugPrivilege	3156	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	3156	AppLaunch.exe
Token: SeChangeNotifyPrivilege	3156	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	3156	AppLaunch.exe
Token: SeUndockPrivilege	3156	AppLaunch.exe
Token: SeManageVolumePrivilege	3156	AppLaunch.exe
Token: SeImpersonatePrivilege	3156	AppLaunch.exe
Token: SeCreateGlobalPrivilege	3156	AppLaunch.exe
Token: 33	3156	AppLaunch.exe
Token: 34	3156	AppLaunch.exe
Token: 35	3156	AppLaunch.exe
Token: 36	3156	AppLaunch.exe
Token: SeDebugPrivilege	2484	VSCover.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3156	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4036	4696	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe	84
PID 4696 wrote to memory of 4036	4696	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe	84
PID 4696 wrote to memory of 4036	4696	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe	84
PID 4696 wrote to memory of 2704	4696	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe	86
PID 4696 wrote to memory of 2704	4696	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe	86
PID 4696 wrote to memory of 2704	4696	55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe	86
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 2704 wrote to memory of 1236	2704	PROTECTED.EXE	88
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 4036 wrote to memory of 3156	4036	JUUU.EXE	89
PID 1236 wrote to memory of 3884	1236	AppLaunch.exe	90
PID 1236 wrote to memory of 3884	1236	AppLaunch.exe	90
PID 1236 wrote to memory of 3884	1236	AppLaunch.exe	90
PID 1236 wrote to memory of 2408	1236	AppLaunch.exe	91
PID 1236 wrote to memory of 2408	1236	AppLaunch.exe	91
PID 1236 wrote to memory of 2408	1236	AppLaunch.exe	91
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 1236 wrote to memory of 4624	1236	AppLaunch.exe	93
PID 4036 wrote to memory of 2484	4036	JUUU.EXE	96
PID 4036 wrote to memory of 2484	4036	JUUU.EXE	96
PID 4036 wrote to memory of 2484	4036	JUUU.EXE	96
PID 2408 wrote to memory of 2712	2408	cmd.exe	97
PID 2408 wrote to memory of 2712	2408	cmd.exe	97
PID 2408 wrote to memory of 2712	2408	cmd.exe	97
PID 3884 wrote to memory of 8	3884	cmd.exe	98

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2712	attrib.exe
8	attrib.exe

C:\Users\Admin\AppData\Local\Temp\55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\55add9edfc6554324406ec3c3f6a28ba_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\JUUU.EXE
  "C:\Users\Admin\AppData\Local\Temp\JUUU.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\Users\Admin\AppData\Local\Temp\PROTECTED.EXE
  "C:\Users\Admin\AppData\Local\Temp\PROTECTED.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - Modifies WinLogon for persistence
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" +s +h
        5⤵
        Sets file to hidden
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:8
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
        5⤵
        Sets file to hidden
        Drops file in Windows directory
        Views/modifies file attributes
        
        PID:2712
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
      "C:\Windows\system32\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JUUU.EXE

Path C:\Users\Admin\AppData\Local\Temp\JUUU.EXE
Size 696KB
SHA256 95600610d4b35d15b1c2b03ca2e23f35f4c9d3fd59d411ba13ef46242c7c4be5
MD5 3e6635dbb2af4a96e6f3b832f3263a37
SHA1 80e8176f3ee2420683c3319bd41fee036e5a8623
SHA512 9e10748684681a813dde149652aae51461b681fd9186beb1c6870ea7209c2bd06448c0e5c6ef1651ed160b7f1213144e1ffc6c221fb87b675d74eeffd1035fde
SSDEEP 12288:YEAowe93XFjKamAOgzs5DiV4kIUGEWF89lFz2f1K7yq7Xz+R6cca3qg:mowcKaJsy4JzFsef1K7ywjcFT3qg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PROTECTED.EXE

Path C:\Users\Admin\AppData\Local\Temp\PROTECTED.EXE
Size 738KB
SHA256 07d906ee9b0624eaed994fb55bfc114d01182fcb3abb4fee6e92e018928ef368
MD5 11ed60e333707ff42507063aacc0996d
SHA1 c8acc8ba6f633dd6853d9d7226e477c9ba6c1546
SHA512 7c31577f5eb72b5da4e8080352ec614a26757884c62f241721cf789fcaf05ef84002a68eded9f2a115768608ce89d50ebd30977df3153cc0e21d1a3ea987ac97
SSDEEP 12288:XEAFpZRiEcWMqWOSbKLUkZJGwyVlVtN79VVaCVGhtnd:JFp5nM5MJGwy7XNBvVGht
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSCover.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VSCover.exe
Size 9KB
SHA256 be262699cd942a22fc312fd0b9f9342f918dd12a1a3eed021f6638cd001332f9
MD5 dc6d36a7c55a3db3716acaa74ed4d7a0
SHA1 e523a92df2d58f32a5c2a737b876633f5ef4096a
SHA512 b2441a7998ddf3b32a3eada6b780f1cd6838dad2055a0c560a284b0f6babfdcc23decdeae9bed2078796e2a8fd587aadf092af6fad2c01c9fc3b8386338800d0
SSDEEP 192:Esv5kBApeJTjC4cfRPMRyqcHA329o1h1y6WKwWr:xCgHA329oD86WKwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdcsc.exe

Path C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Size 57KB
SHA256 7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
MD5 454501a66ad6e85175a6757573d79f8b
SHA1 8ca96c61f26a640a5b1b1152d055260b9d43e308
SHA512 9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
SSDEEP 1536:ZNjIcq3kESJ3Us2d5n0JrxLpOtMkcXeiu:ZNjEkEAYdWJrppOtMkcXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1236-33-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1236-31-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1236-37-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/2704-25-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/2704-30-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/2704-38-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/3156-36-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3156-34-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3156-35-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3156-43-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3156-42-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/4036-24-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/4036-23-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/4036-22-0x0000000073832000-0x0000000073833000-memory.dmp

Download

memory/4036-113-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/4036-114-0x0000000073832000-0x0000000073833000-memory.dmp

Download

memory/4036-115-0x0000000073830000-0x0000000073DE1000-memory.dmp

Download

memory/4624-44-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download