darkcomet | 7952a11768d2762889c98648d15dbcbf90c8f5f6ddd11439ae0e5c3433cb3b0f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/10/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MW3 Aimbot 1.17.exe
Size

734KB
MD5

6f661717f822d043cce6b34cafc904e8
SHA1

225bfbe18919298748a505cf0ebf80229f228f45
SHA256

86bfd8592ba81d9134fc04ca1c0a9dc2df8a9cb757ca0fc57d955be0ff151900
SHA512

cb6a83f59b769c3ab4f3bc8d620f561d9271924623a08d3bfc9bde9a646a9ac91de735e98f14e24f32a1b60f08843f2e0ee7bf4912d2c76ff58cf75f14e860a5
SSDEEP

12288:csT1ncdi3W6kBcMvSy4lKmtwH9PIB6sfuUoUIkINKEEdbNhIHhQ7deG44KVNW2JW:bT1nsDay+ujuudU9IUZdpKBwAGIXkL8M

Score

10^/10

darkcomet darkcomet discovery evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
ligotti19

Extracted

Family

darkcomet

Botnet

DarkComet

imsocoolbeans.no-ip.biz:1200

Mutex

DC_MUTEX-BQA5EB5

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
P8PVu3Y0o1qm
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe,Explorer.exe"	MW3 AIMBOT PATCHER.EXE

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2508	attrib.exe
2676	attrib.exe

Executes dropped EXE 5 IoCs

pid	Process
2944	tmpB1D2.tmp.exe
2308	MW3 AIMBOT PATCHER.EXE
2428	MW3 AIMBOT.EXE
2324	WinUpdater.exe
2940	msdcsc.exe

Loads dropped DLL 5 IoCs

pid	Process
1908	MW3 Aimbot 1.17.exe
2064	vbc.exe
2064	vbc.exe
2064	vbc.exe
2064	vbc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\1417875456 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB1D2.tmp.exe\""	tmpB1D2.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\RUNDLL32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB1D2.tmp.exe"	MW3 Aimbot 1.17.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysAudio.exe"	MW3 AIMBOT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysAudio.exe"	WinUpdater.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 2064	1908	MW3 Aimbot 1.17.exe	31

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MW3 Aimbot 1.17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MW3 AIMBOT PATCHER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB1D2.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2324	WinUpdater.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	MW3 Aimbot 1.17.exe
Token: SeDebugPrivilege	2944	tmpB1D2.tmp.exe
Token: SeIncreaseQuotaPrivilege	2064	vbc.exe
Token: SeSecurityPrivilege	2064	vbc.exe
Token: SeTakeOwnershipPrivilege	2064	vbc.exe
Token: SeLoadDriverPrivilege	2064	vbc.exe
Token: SeSystemProfilePrivilege	2064	vbc.exe
Token: SeSystemtimePrivilege	2064	vbc.exe
Token: SeProfSingleProcessPrivilege	2064	vbc.exe
Token: SeIncBasePriorityPrivilege	2064	vbc.exe
Token: SeCreatePagefilePrivilege	2064	vbc.exe
Token: SeBackupPrivilege	2064	vbc.exe
Token: SeRestorePrivilege	2064	vbc.exe
Token: SeShutdownPrivilege	2064	vbc.exe
Token: SeDebugPrivilege	2064	vbc.exe
Token: SeSystemEnvironmentPrivilege	2064	vbc.exe
Token: SeChangeNotifyPrivilege	2064	vbc.exe
Token: SeRemoteShutdownPrivilege	2064	vbc.exe
Token: SeUndockPrivilege	2064	vbc.exe
Token: SeManageVolumePrivilege	2064	vbc.exe
Token: SeImpersonatePrivilege	2064	vbc.exe
Token: SeCreateGlobalPrivilege	2064	vbc.exe
Token: 33	2064	vbc.exe
Token: 34	2064	vbc.exe
Token: 35	2064	vbc.exe
Token: SeDebugPrivilege	2428	MW3 AIMBOT.EXE
Token: 33	2428	MW3 AIMBOT.EXE
Token: SeIncBasePriorityPrivilege	2428	MW3 AIMBOT.EXE
Token: SeDebugPrivilege	2324	WinUpdater.exe
Token: 33	2324	WinUpdater.exe
Token: SeIncBasePriorityPrivilege	2324	WinUpdater.exe
Token: SeDebugPrivilege	2308	MW3 AIMBOT PATCHER.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2428	MW3 AIMBOT.EXE
2324	WinUpdater.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2944	1908	MW3 Aimbot 1.17.exe	30
PID 1908 wrote to memory of 2944	1908	MW3 Aimbot 1.17.exe	30
PID 1908 wrote to memory of 2944	1908	MW3 Aimbot 1.17.exe	30
PID 1908 wrote to memory of 2944	1908	MW3 Aimbot 1.17.exe	30
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 1908 wrote to memory of 2064	1908	MW3 Aimbot 1.17.exe	31
PID 2064 wrote to memory of 2620	2064	vbc.exe	32
PID 2064 wrote to memory of 2620	2064	vbc.exe	32
PID 2064 wrote to memory of 2620	2064	vbc.exe	32
PID 2064 wrote to memory of 2620	2064	vbc.exe	32
PID 2064 wrote to memory of 2336	2064	vbc.exe	33
PID 2064 wrote to memory of 2336	2064	vbc.exe	33
PID 2064 wrote to memory of 2336	2064	vbc.exe	33
PID 2064 wrote to memory of 2336	2064	vbc.exe	33
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2308	2064	vbc.exe	35
PID 2064 wrote to memory of 2428	2064	vbc.exe	37
PID 2064 wrote to memory of 2428	2064	vbc.exe	37
PID 2064 wrote to memory of 2428	2064	vbc.exe	37
PID 2064 wrote to memory of 2428	2064	vbc.exe	37
PID 2336 wrote to memory of 2508	2336	cmd.exe	38
PID 2336 wrote to memory of 2508	2336	cmd.exe	38
PID 2336 wrote to memory of 2508	2336	cmd.exe	38
PID 2336 wrote to memory of 2508	2336	cmd.exe	38
PID 2620 wrote to memory of 2676	2620	cmd.exe	39
PID 2620 wrote to memory of 2676	2620	cmd.exe	39
PID 2620 wrote to memory of 2676	2620	cmd.exe	39
PID 2620 wrote to memory of 2676	2620	cmd.exe	39
PID 2428 wrote to memory of 2324	2428	MW3 AIMBOT.EXE	40
PID 2428 wrote to memory of 2324	2428	MW3 AIMBOT.EXE	40
PID 2428 wrote to memory of 2324	2428	MW3 AIMBOT.EXE	40
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41
PID 2064 wrote to memory of 2680	2064	vbc.exe	41

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2508	attrib.exe
2676	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MW3 Aimbot 1.17.exe
"C:\Users\Admin\AppData\Local\Temp\MW3 Aimbot 1.17.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\tmpB1D2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB1D2.tmp.exe" /pq
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2508
- - C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT PATCHER.EXE
    "C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT PATCHER.EXE"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT.EXE
    "C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT.EXE"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WinUpdater.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\WinUpdater.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2324
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
\Users\Admin\AppData\Local\Temp\MW3 AIMBOT PATCHER.EXE

Filesize
28KB

MD5
e293276c284b94d1bb077f58d1831181

SHA1
5984a39364e814691cb69954447731fc1dc3fc11

SHA256
512ab11bf1b812d2b00d3cee9dd7b654d2aeddcd7b5622716140e725fa7d04bc

SHA512
677d9d7167a907e9faafa100431825a590558b44aaa2f9384bb24bde4b9b795b8c4dd0f24f8528fbbfca8e0b06757f3bd1a240f4d817b43f52f0412b6f3f6197

Download Submit
\Users\Admin\AppData\Local\Temp\MW3 AIMBOT.EXE

Filesize
48KB

MD5
aa288aea58f791b8be539e90491d72a5

SHA1
123e8b8b3cda53afc5f9c90ec394127f0364a626

SHA256
872cd4a24881b39989ec3747948f27e2094d2bc015c62ac0f90f6ebc29f0e1fd

SHA512
f099bf4c6c15c8c2ca652a2425cbb4c69da95339796d34700445008bae5dac93767567eaa77ef28a0d78336770bba244f49a76318bdac7bb768e08e5f06e32b0

Download Submit
\Users\Admin\AppData\Local\Temp\tmpB1D2.tmp.exe

Filesize
734KB

MD5
6f661717f822d043cce6b34cafc904e8

SHA1
225bfbe18919298748a505cf0ebf80229f228f45

SHA256
86bfd8592ba81d9134fc04ca1c0a9dc2df8a9cb757ca0fc57d955be0ff151900

SHA512
cb6a83f59b769c3ab4f3bc8d620f561d9271924623a08d3bfc9bde9a646a9ac91de735e98f14e24f32a1b60f08843f2e0ee7bf4912d2c76ff58cf75f14e860a5

Download Submit
memory/1908-0-0x00000000741A1000-0x00000000741A2000-memory.dmp

Filesize
4KB

Download
memory/1908-1-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/1908-2-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/1908-104-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2064-29-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-18-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-39-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2064-35-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-32-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-14-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-25-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-21-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-40-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-15-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-13-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2064-101-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2308-61-0x0000000000120000-0x000000000012C000-memory.dmp

Filesize
48KB

Download
memory/2308-63-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2680-94-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2680-66-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2944-11-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2944-12-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2944-10-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download