darkcomet | 7952a11768d2762889c98648d15dbcbf90c8f5f6ddd11439ae0e5c3433cb3b0f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MW3 Aimbot 1.17.exe
Size

734KB
MD5

6f661717f822d043cce6b34cafc904e8
SHA1

225bfbe18919298748a505cf0ebf80229f228f45
SHA256

86bfd8592ba81d9134fc04ca1c0a9dc2df8a9cb757ca0fc57d955be0ff151900
SHA512

cb6a83f59b769c3ab4f3bc8d620f561d9271924623a08d3bfc9bde9a646a9ac91de735e98f14e24f32a1b60f08843f2e0ee7bf4912d2c76ff58cf75f14e860a5
SSDEEP

12288:csT1ncdi3W6kBcMvSy4lKmtwH9PIB6sfuUoUIkINKEEdbNhIHhQ7deG44KVNW2JW:bT1nsDay+ujuudU9IUZdpKBwAGIXkL8M

Score

10^/10

darkcomet darkcomet discovery evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
ligotti19

Extracted

Family

darkcomet

Botnet

DarkComet

imsocoolbeans.no-ip.biz:1200

Mutex

DC_MUTEX-BQA5EB5

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
P8PVu3Y0o1qm
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe,Explorer.exe"	MW3 AIMBOT PATCHER.EXE

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1864	attrib.exe
5092	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	MW3 Aimbot 1.17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	MW3 AIMBOT.EXE

Executes dropped EXE 5 IoCs

pid	Process
1916	tmp9A8A.tmp.exe
2384	MW3 AIMBOT PATCHER.EXE
1740	MW3 AIMBOT.EXE
3548	WinUpdater.exe
1292	msdcsc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysAudio.exe"	MW3 AIMBOT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysAudio.exe"	WinUpdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\611581709 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9A8A.tmp.exe\""	tmp9A8A.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RUNDLL32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9A8A.tmp.exe"	MW3 Aimbot 1.17.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 4944	2712	MW3 Aimbot 1.17.exe	83

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MW3 Aimbot 1.17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9A8A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MW3 AIMBOT PATCHER.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3548	WinUpdater.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	MW3 Aimbot 1.17.exe
Token: SeDebugPrivilege	1916	tmp9A8A.tmp.exe
Token: SeIncreaseQuotaPrivilege	4944	vbc.exe
Token: SeSecurityPrivilege	4944	vbc.exe
Token: SeTakeOwnershipPrivilege	4944	vbc.exe
Token: SeLoadDriverPrivilege	4944	vbc.exe
Token: SeSystemProfilePrivilege	4944	vbc.exe
Token: SeSystemtimePrivilege	4944	vbc.exe
Token: SeProfSingleProcessPrivilege	4944	vbc.exe
Token: SeIncBasePriorityPrivilege	4944	vbc.exe
Token: SeCreatePagefilePrivilege	4944	vbc.exe
Token: SeBackupPrivilege	4944	vbc.exe
Token: SeRestorePrivilege	4944	vbc.exe
Token: SeShutdownPrivilege	4944	vbc.exe
Token: SeDebugPrivilege	4944	vbc.exe
Token: SeSystemEnvironmentPrivilege	4944	vbc.exe
Token: SeChangeNotifyPrivilege	4944	vbc.exe
Token: SeRemoteShutdownPrivilege	4944	vbc.exe
Token: SeUndockPrivilege	4944	vbc.exe
Token: SeManageVolumePrivilege	4944	vbc.exe
Token: SeImpersonatePrivilege	4944	vbc.exe
Token: SeCreateGlobalPrivilege	4944	vbc.exe
Token: 33	4944	vbc.exe
Token: 34	4944	vbc.exe
Token: 35	4944	vbc.exe
Token: 36	4944	vbc.exe
Token: SeDebugPrivilege	2384	MW3 AIMBOT PATCHER.EXE
Token: SeDebugPrivilege	1740	MW3 AIMBOT.EXE
Token: 33	1740	MW3 AIMBOT.EXE
Token: SeIncBasePriorityPrivilege	1740	MW3 AIMBOT.EXE
Token: SeDebugPrivilege	3548	WinUpdater.exe
Token: 33	3548	WinUpdater.exe
Token: SeIncBasePriorityPrivilege	3548	WinUpdater.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1740	MW3 AIMBOT.EXE
3548	WinUpdater.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1916	2712	MW3 Aimbot 1.17.exe	82
PID 2712 wrote to memory of 1916	2712	MW3 Aimbot 1.17.exe	82
PID 2712 wrote to memory of 1916	2712	MW3 Aimbot 1.17.exe	82
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 2712 wrote to memory of 4944	2712	MW3 Aimbot 1.17.exe	83
PID 4944 wrote to memory of 3652	4944	vbc.exe	84
PID 4944 wrote to memory of 3652	4944	vbc.exe	84
PID 4944 wrote to memory of 3652	4944	vbc.exe	84
PID 4944 wrote to memory of 4684	4944	vbc.exe	85
PID 4944 wrote to memory of 4684	4944	vbc.exe	85
PID 4944 wrote to memory of 4684	4944	vbc.exe	85
PID 4944 wrote to memory of 2384	4944	vbc.exe	88
PID 4944 wrote to memory of 2384	4944	vbc.exe	88
PID 4944 wrote to memory of 2384	4944	vbc.exe	88
PID 4944 wrote to memory of 1740	4944	vbc.exe	89
PID 4944 wrote to memory of 1740	4944	vbc.exe	89
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 4944 wrote to memory of 4080	4944	vbc.exe	90
PID 3652 wrote to memory of 1864	3652	cmd.exe	91
PID 3652 wrote to memory of 1864	3652	cmd.exe	91
PID 3652 wrote to memory of 1864	3652	cmd.exe	91
PID 4684 wrote to memory of 5092	4684	cmd.exe	92
PID 4684 wrote to memory of 5092	4684	cmd.exe	92
PID 4684 wrote to memory of 5092	4684	cmd.exe	92
PID 1740 wrote to memory of 3548	1740	MW3 AIMBOT.EXE	93
PID 1740 wrote to memory of 3548	1740	MW3 AIMBOT.EXE	93
PID 4944 wrote to memory of 1292	4944	vbc.exe	94
PID 4944 wrote to memory of 1292	4944	vbc.exe	94
PID 4944 wrote to memory of 1292	4944	vbc.exe	94

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5092	attrib.exe
1864	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MW3 Aimbot 1.17.exe
"C:\Users\Admin\AppData\Local\Temp\MW3 Aimbot 1.17.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp.exe" /pq
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5092
- - C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT PATCHER.EXE
    "C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT PATCHER.EXE"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT.EXE
    "C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT.EXE"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WinUpdater.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\WinUpdater.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3548
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT PATCHER.EXE

Filesize
28KB

MD5
e293276c284b94d1bb077f58d1831181

SHA1
5984a39364e814691cb69954447731fc1dc3fc11

SHA256
512ab11bf1b812d2b00d3cee9dd7b654d2aeddcd7b5622716140e725fa7d04bc

SHA512
677d9d7167a907e9faafa100431825a590558b44aaa2f9384bb24bde4b9b795b8c4dd0f24f8528fbbfca8e0b06757f3bd1a240f4d817b43f52f0412b6f3f6197

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW3 AIMBOT.EXE

Filesize
48KB

MD5
aa288aea58f791b8be539e90491d72a5

SHA1
123e8b8b3cda53afc5f9c90ec394127f0364a626

SHA256
872cd4a24881b39989ec3747948f27e2094d2bc015c62ac0f90f6ebc29f0e1fd

SHA512
f099bf4c6c15c8c2ca652a2425cbb4c69da95339796d34700445008bae5dac93767567eaa77ef28a0d78336770bba244f49a76318bdac7bb768e08e5f06e32b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp.exe

Filesize
734KB

MD5
6f661717f822d043cce6b34cafc904e8

SHA1
225bfbe18919298748a505cf0ebf80229f228f45

SHA256
86bfd8592ba81d9134fc04ca1c0a9dc2df8a9cb757ca0fc57d955be0ff151900

SHA512
cb6a83f59b769c3ab4f3bc8d620f561d9271924623a08d3bfc9bde9a646a9ac91de735e98f14e24f32a1b60f08843f2e0ee7bf4912d2c76ff58cf75f14e860a5

Download Submit
memory/1740-111-0x000000001C9C0000-0x000000001CA5C000-memory.dmp

Filesize
624KB

Download
memory/1740-59-0x000000001BC80000-0x000000001BD26000-memory.dmp

Filesize
664KB

Download
memory/1740-109-0x000000001C200000-0x000000001C6CE000-memory.dmp

Filesize
4.8MB

Download
memory/1916-14-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/1916-17-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/1916-16-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/2384-57-0x0000000000AD0000-0x0000000000AD6000-memory.dmp

Filesize
24KB

Download
memory/2384-56-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/2712-129-0x00000000754F2000-0x00000000754F3000-memory.dmp

Filesize
4KB

Download
memory/2712-130-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/2712-2-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/2712-1-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/2712-0-0x00000000754F2000-0x00000000754F3000-memory.dmp

Filesize
4KB

Download
memory/3548-124-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Filesize
32KB

Download
memory/4080-58-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/4944-20-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-22-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-24-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-30-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4944-25-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-29-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-28-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-26-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-126-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-18-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4944-19-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download