darkcomet | f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Size

1.3MB
MD5

6463d8b3b095662598d9823df35c5c70
SHA1

6ec181e03393deba51664099dc1e8f3ad5041909
SHA256

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384
SHA512

10c630672fb873857f71129998daab94054a6fb8573f2cd62b6090dba2b987d1ce776ef9bb115a8cf8356a987cb02107d7e4ffe6a2461598d40c7ba7817625fe
SSDEEP

24576:Ej6wLhExiZNzXaAc4yc3fNs5OzlKT8FGdg1XaNWtrA5jdv2s9toMWuYc2Z/T:EmwLhbraAly0fZzlZGdgsMt03Os97WuY

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windupdt\\winupdate.exe"	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe

Executes dropped EXE 1 IoCs

Processes:

winupdate.exe

pid	Process
2516	winupdate.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	winupdate.exe

Loads dropped DLL 4 IoCs

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

pid	Process
1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
2516	winupdate.exe
2516	winupdate.exe
2516	winupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windupdt\\winupdate.exe"	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

pid	Process
1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
2516	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exeDllHost.exewinupdate.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winupdate.exef6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

pid	Process
1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
2516	winupdate.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exewinupdate.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeSecurityPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeTakeOwnershipPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeLoadDriverPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeSystemProfilePrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeSystemtimePrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeProfSingleProcessPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeIncBasePriorityPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeCreatePagefilePrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeBackupPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeRestorePrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeShutdownPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeDebugPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeSystemEnvironmentPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeChangeNotifyPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeRemoteShutdownPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeUndockPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeManageVolumePrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeImpersonatePrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeCreateGlobalPrivilege	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: 33	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: 34	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: 35	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
Token: SeIncreaseQuotaPrivilege	2516	winupdate.exe
Token: SeSecurityPrivilege	2516	winupdate.exe
Token: SeTakeOwnershipPrivilege	2516	winupdate.exe
Token: SeLoadDriverPrivilege	2516	winupdate.exe
Token: SeSystemProfilePrivilege	2516	winupdate.exe
Token: SeSystemtimePrivilege	2516	winupdate.exe
Token: SeProfSingleProcessPrivilege	2516	winupdate.exe
Token: SeIncBasePriorityPrivilege	2516	winupdate.exe
Token: SeCreatePagefilePrivilege	2516	winupdate.exe
Token: SeBackupPrivilege	2516	winupdate.exe
Token: SeRestorePrivilege	2516	winupdate.exe
Token: SeShutdownPrivilege	2516	winupdate.exe
Token: SeDebugPrivilege	2516	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2516	winupdate.exe
Token: SeChangeNotifyPrivilege	2516	winupdate.exe
Token: SeRemoteShutdownPrivilege	2516	winupdate.exe
Token: SeUndockPrivilege	2516	winupdate.exe
Token: SeManageVolumePrivilege	2516	winupdate.exe
Token: SeImpersonatePrivilege	2516	winupdate.exe
Token: SeCreateGlobalPrivilege	2516	winupdate.exe
Token: 33	2516	winupdate.exe
Token: 34	2516	winupdate.exe
Token: 35	2516	winupdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid	Process
2972	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DllHost.exe

pid	Process
2972	DllHost.exe
2972	DllHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe

description	pid	Process	procid_target
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31
PID 1740 wrote to memory of 2516	1740	f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe	31

C:\Users\Admin\AppData\Local\Temp\f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe
"C:\Users\Admin\AppData\Local\Temp\f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384N.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\ProgramData\Microsoft\Windows\Start Menu\Windupdt\winupdate.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\Windupdt\winupdate.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Windupdt\winupdate.exe

Filesize
1.3MB

MD5
6463d8b3b095662598d9823df35c5c70

SHA1
6ec181e03393deba51664099dc1e8f3ad5041909

SHA256
f6f652122c7da8d27ca7084a40da94050632d6694ed7e976f9b72977a3d77384

SHA512
10c630672fb873857f71129998daab94054a6fb8573f2cd62b6090dba2b987d1ce776ef9bb115a8cf8356a987cb02107d7e4ffe6a2461598d40c7ba7817625fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\I-LOVE-YOU-I-HATE-YOU.JPG

Filesize
29KB

MD5
cbff8e34ba2a48833132e4352ee89a51

SHA1
f96c65311a24b09315aaf83701b9117bc6916bd0

SHA256
5c178508280b885187eb411475f98a220c214870942afce6932b74284bd3cbb9

SHA512
6d9702a312ce1cef9bbf191a5df51d606238a80c705f0e78a051ce234fb12569fff52594e1ada4686ea0ac249d189fdfab02f2d3a92c013ebcc107ae4883793b

Download Submit
memory/1740-0-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1740-1-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download
memory/1740-8-0x0000000003330000-0x0000000003430000-memory.dmp

Filesize
1024KB

Download
memory/1740-7-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1740-6-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1740-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1740-16-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-26-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-25-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-24-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-23-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-22-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-21-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-20-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-19-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-18-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-17-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-15-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-14-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-13-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-12-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-11-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-10-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-9-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1740-2-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1740-27-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1740-29-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1740-32-0x0000000006EC0000-0x0000000006EC2000-memory.dmp

Filesize
8KB

Download
memory/1740-59-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-58-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-57-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-56-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-55-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-54-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-53-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-52-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-51-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-50-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-49-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-48-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-47-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-46-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-45-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-44-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1740-41-0x00000000071F0000-0x00000000074AA000-memory.dmp

Filesize
2.7MB

Download
memory/1740-40-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/1740-39-0x0000000003330000-0x0000000003430000-memory.dmp

Filesize
1024KB

Download
memory/1740-38-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download
memory/2516-63-0x0000000000C20000-0x0000000000EDA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-65-0x0000000000C20000-0x0000000000EDA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-62-0x0000000000C20000-0x0000000000EDA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-67-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-68-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-69-0x0000000000C20000-0x0000000000EDA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-70-0x0000000000C20000-0x0000000000EDA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-71-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-72-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-73-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-74-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-75-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-76-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-77-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-78-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-79-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-80-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2516-81-0x0000000000400000-0x00000000006BA000-memory.dmp

Filesize
2.7MB

Download
memory/2972-33-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download