darkcomet | c68a0d0e2e7c63925373033ae2a5a9700b14dfe7847e0f5e339d8ed0be11b758

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bitbot_v2.8_SETUP.exe
Size

394KB
MD5

83b9c0ccfc41bcf9900d13d3de74ba3b
SHA1

d2dddf0c6c5e6ce45f3ebf3d89826ed64fdab610
SHA256

32b7afcb5c386847d67df435dd1ee685d7afa39bc0fac4437f054c5546af25dd
SHA512

2181189443bda3126c4e2335d355454eee3c9576292fd9485dc75839c04cf64dc0f13c58db52f202f513d5ff342c688ca1b44f013db66d68423d22b0b5caa139
SSDEEP

6144:gMU81mKGzOr2+krxLCPy95PNbyIn+dmge0qOxS+NfMA90ZnMaN/j:gMdmKWOa+wxWPiPNbDfCS+FMA90ZnD/

Score

10^/10

darkcomet day1 discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Day1

epicdust.servecounterstrike.com:1604

Mutex

DC_MUTEX-FE50JVD

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
85dtHfaBqD8E
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\wdisplay.exe"	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
2940	wdisplay.exe
2768	msdcsc.exe
2724	memtest.exe
1036	wdisplay.exe

Loads dropped DLL 4 IoCs

pid	Process
2584	bitbot_v2.8_SETUP.exe
2424	AppLaunch.exe
2940	wdisplay.exe
2584	bitbot_v2.8_SETUP.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2724 set thread context of 1152	2724	memtest.exe	39

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2424-17-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-16-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-12-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-10-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-18-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-23-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-22-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-21-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-20-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2424-38-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1152-52-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1152-54-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1152-53-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1152-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1152-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitbot_v2.8_SETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memtest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdisplay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdisplay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2584	bitbot_v2.8_SETUP.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2584	bitbot_v2.8_SETUP.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2584	bitbot_v2.8_SETUP.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2584	bitbot_v2.8_SETUP.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe
2940	wdisplay.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	bitbot_v2.8_SETUP.exe
Token: SeIncreaseQuotaPrivilege	2424	AppLaunch.exe
Token: SeSecurityPrivilege	2424	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	2424	AppLaunch.exe
Token: SeLoadDriverPrivilege	2424	AppLaunch.exe
Token: SeSystemProfilePrivilege	2424	AppLaunch.exe
Token: SeSystemtimePrivilege	2424	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	2424	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	2424	AppLaunch.exe
Token: SeCreatePagefilePrivilege	2424	AppLaunch.exe
Token: SeBackupPrivilege	2424	AppLaunch.exe
Token: SeRestorePrivilege	2424	AppLaunch.exe
Token: SeShutdownPrivilege	2424	AppLaunch.exe
Token: SeDebugPrivilege	2424	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	2424	AppLaunch.exe
Token: SeChangeNotifyPrivilege	2424	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	2424	AppLaunch.exe
Token: SeUndockPrivilege	2424	AppLaunch.exe
Token: SeManageVolumePrivilege	2424	AppLaunch.exe
Token: SeImpersonatePrivilege	2424	AppLaunch.exe
Token: SeCreateGlobalPrivilege	2424	AppLaunch.exe
Token: 33	2424	AppLaunch.exe
Token: 34	2424	AppLaunch.exe
Token: 35	2424	AppLaunch.exe
Token: SeDebugPrivilege	2940	wdisplay.exe
Token: SeDebugPrivilege	2724	memtest.exe
Token: SeDebugPrivilege	1036	wdisplay.exe
Token: SeIncreaseQuotaPrivilege	1152	AppLaunch.exe
Token: SeSecurityPrivilege	1152	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	1152	AppLaunch.exe
Token: SeLoadDriverPrivilege	1152	AppLaunch.exe
Token: SeSystemProfilePrivilege	1152	AppLaunch.exe
Token: SeSystemtimePrivilege	1152	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	1152	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	1152	AppLaunch.exe
Token: SeCreatePagefilePrivilege	1152	AppLaunch.exe
Token: SeBackupPrivilege	1152	AppLaunch.exe
Token: SeRestorePrivilege	1152	AppLaunch.exe
Token: SeShutdownPrivilege	1152	AppLaunch.exe
Token: SeDebugPrivilege	1152	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	1152	AppLaunch.exe
Token: SeChangeNotifyPrivilege	1152	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	1152	AppLaunch.exe
Token: SeUndockPrivilege	1152	AppLaunch.exe
Token: SeManageVolumePrivilege	1152	AppLaunch.exe
Token: SeImpersonatePrivilege	1152	AppLaunch.exe
Token: SeCreateGlobalPrivilege	1152	AppLaunch.exe
Token: 33	1152	AppLaunch.exe
Token: 34	1152	AppLaunch.exe
Token: 35	1152	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1152	AppLaunch.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2424	2584	bitbot_v2.8_SETUP.exe	31
PID 2584 wrote to memory of 2940	2584	bitbot_v2.8_SETUP.exe	32
PID 2584 wrote to memory of 2940	2584	bitbot_v2.8_SETUP.exe	32
PID 2584 wrote to memory of 2940	2584	bitbot_v2.8_SETUP.exe	32
PID 2584 wrote to memory of 2940	2584	bitbot_v2.8_SETUP.exe	32
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2424 wrote to memory of 2768	2424	AppLaunch.exe	33
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2724	2940	wdisplay.exe	35
PID 2940 wrote to memory of 2704	2940	wdisplay.exe	34
PID 2940 wrote to memory of 2704	2940	wdisplay.exe	34
PID 2940 wrote to memory of 2704	2940	wdisplay.exe	34
PID 2940 wrote to memory of 2704	2940	wdisplay.exe	34
PID 2704 wrote to memory of 2412	2704	cmd.exe	37
PID 2704 wrote to memory of 2412	2704	cmd.exe	37
PID 2704 wrote to memory of 2412	2704	cmd.exe	37
PID 2704 wrote to memory of 2412	2704	cmd.exe	37
PID 2584 wrote to memory of 1036	2584	bitbot_v2.8_SETUP.exe	38
PID 2584 wrote to memory of 1036	2584	bitbot_v2.8_SETUP.exe	38
PID 2584 wrote to memory of 1036	2584	bitbot_v2.8_SETUP.exe	38
PID 2584 wrote to memory of 1036	2584	bitbot_v2.8_SETUP.exe	38
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39
PID 2724 wrote to memory of 1152	2724	memtest.exe	39

C:\Users\Admin\AppData\Local\Temp\bitbot_v2.8_SETUP.exe
"C:\Users\Admin\AppData\Local\Temp\bitbot_v2.8_SETUP.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2768
- C:\Users\Admin\AppData\Local\Temp\wdisplay.exe
  "C:\Users\Admin\AppData\Local\Temp\wdisplay.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /d "C:\Windows\explorer.exe, C:\Users\Admin\AppData\Local\Temp\wdisplay.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /d "C:\Windows\explorer.exe, C:\Users\Admin\AppData\Local\Temp\wdisplay.exe" /f
      4⤵
      Modifies WinLogon for persistence
      System Location Discovery: System Language Discovery
      PID:2412
- - C:\Users\Admin\AppData\Local\Temp\memtest.exe
    "C:\Users\Admin\AppData\Local\Temp\memtest.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1152
- C:\Users\Admin\AppData\Local\Temp\wdisplay.exe
  "C:\Users\Admin\AppData\Local\Temp\wdisplay.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wdisplay.exe

Filesize
9KB

MD5
08ab5643b6469e0563d02f25a5d45de6

SHA1
32556b524c38559de2bf31e08883ca20e20a2b66

SHA256
fc070a7f806d5ad7df330bb774d3a2708ed5576d6a113dad3f20a52e3400d7b7

SHA512
090cf8e8f9478e2dd9c9d86cec7d3be1c846903b652d2cccfb01114ce2a689403ccb2527f74fccd37fb4ef84a3ab0bf2ea84fdce1429c48e05020a8dc9a2595f

Download Submit
\Users\Admin\AppData\Local\Temp\memtest.exe

Filesize
394KB

MD5
83b9c0ccfc41bcf9900d13d3de74ba3b

SHA1
d2dddf0c6c5e6ce45f3ebf3d89826ed64fdab610

SHA256
32b7afcb5c386847d67df435dd1ee685d7afa39bc0fac4437f054c5546af25dd

SHA512
2181189443bda3126c4e2335d355454eee3c9576292fd9485dc75839c04cf64dc0f13c58db52f202f513d5ff342c688ca1b44f013db66d68423d22b0b5caa139

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
memory/1152-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1152-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1152-53-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1152-54-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1152-52-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2424-10-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-8-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-23-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-22-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-21-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-20-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-18-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-12-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-38-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-17-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2424-16-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2584-0-0x0000000074B31000-0x0000000074B32000-memory.dmp

Filesize
4KB

Download
memory/2584-3-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2584-1-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2584-2-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download