darkcomet | c68a0d0e2e7c63925373033ae2a5a9700b14dfe7847e0f5e339d8ed0be11b758

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bitbot_v2.8_SETUP.exe
Size

394KB
MD5

83b9c0ccfc41bcf9900d13d3de74ba3b
SHA1

d2dddf0c6c5e6ce45f3ebf3d89826ed64fdab610
SHA256

32b7afcb5c386847d67df435dd1ee685d7afa39bc0fac4437f054c5546af25dd
SHA512

2181189443bda3126c4e2335d355454eee3c9576292fd9485dc75839c04cf64dc0f13c58db52f202f513d5ff342c688ca1b44f013db66d68423d22b0b5caa139
SSDEEP

6144:gMU81mKGzOr2+krxLCPy95PNbyIn+dmge0qOxS+NfMA90ZnMaN/j:gMdmKWOa+wxWPiPNbDfCS+FMA90ZnD/

Score

10^/10

darkcomet day1 discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Day1

epicdust.servecounterstrike.com:1604

Mutex

DC_MUTEX-FE50JVD

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
85dtHfaBqD8E
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\wdisplay.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	AppLaunch.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	bitbot_v2.8_SETUP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	wdisplay.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	memtest.exe

Executes dropped EXE 4 IoCs

pid	Process
2620	msdcsc.exe
396	wdisplay.exe
4368	memtest.exe
4800	wdisplay.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	AppLaunch.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4368 set thread context of 4064	4368	memtest.exe	100

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3180-9-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3180-10-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3180-11-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3180-12-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3180-13-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3180-40-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4064-53-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4064-54-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4064-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4064-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	bitbot_v2.8_SETUP.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	bitbot_v2.8_SETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitbot_v2.8_SETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdisplay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memtest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdisplay.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
4564	bitbot_v2.8_SETUP.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
4564	bitbot_v2.8_SETUP.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
4564	bitbot_v2.8_SETUP.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
4564	bitbot_v2.8_SETUP.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe
396	wdisplay.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	bitbot_v2.8_SETUP.exe
Token: SeIncreaseQuotaPrivilege	3180	AppLaunch.exe
Token: SeSecurityPrivilege	3180	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	3180	AppLaunch.exe
Token: SeLoadDriverPrivilege	3180	AppLaunch.exe
Token: SeSystemProfilePrivilege	3180	AppLaunch.exe
Token: SeSystemtimePrivilege	3180	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	3180	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	3180	AppLaunch.exe
Token: SeCreatePagefilePrivilege	3180	AppLaunch.exe
Token: SeBackupPrivilege	3180	AppLaunch.exe
Token: SeRestorePrivilege	3180	AppLaunch.exe
Token: SeShutdownPrivilege	3180	AppLaunch.exe
Token: SeDebugPrivilege	3180	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	3180	AppLaunch.exe
Token: SeChangeNotifyPrivilege	3180	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	3180	AppLaunch.exe
Token: SeUndockPrivilege	3180	AppLaunch.exe
Token: SeManageVolumePrivilege	3180	AppLaunch.exe
Token: SeImpersonatePrivilege	3180	AppLaunch.exe
Token: SeCreateGlobalPrivilege	3180	AppLaunch.exe
Token: 33	3180	AppLaunch.exe
Token: 34	3180	AppLaunch.exe
Token: 35	3180	AppLaunch.exe
Token: 36	3180	AppLaunch.exe
Token: SeDebugPrivilege	396	wdisplay.exe
Token: SeDebugPrivilege	4368	memtest.exe
Token: SeIncreaseQuotaPrivilege	4064	AppLaunch.exe
Token: SeSecurityPrivilege	4064	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	4064	AppLaunch.exe
Token: SeLoadDriverPrivilege	4064	AppLaunch.exe
Token: SeSystemProfilePrivilege	4064	AppLaunch.exe
Token: SeSystemtimePrivilege	4064	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	4064	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	4064	AppLaunch.exe
Token: SeCreatePagefilePrivilege	4064	AppLaunch.exe
Token: SeBackupPrivilege	4064	AppLaunch.exe
Token: SeRestorePrivilege	4064	AppLaunch.exe
Token: SeShutdownPrivilege	4064	AppLaunch.exe
Token: SeDebugPrivilege	4064	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	4064	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4064	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	4064	AppLaunch.exe
Token: SeUndockPrivilege	4064	AppLaunch.exe
Token: SeManageVolumePrivilege	4064	AppLaunch.exe
Token: SeImpersonatePrivilege	4064	AppLaunch.exe
Token: SeCreateGlobalPrivilege	4064	AppLaunch.exe
Token: 33	4064	AppLaunch.exe
Token: 34	4064	AppLaunch.exe
Token: 35	4064	AppLaunch.exe
Token: 36	4064	AppLaunch.exe
Token: SeDebugPrivilege	4800	wdisplay.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4064	AppLaunch.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 4564 wrote to memory of 3180	4564	bitbot_v2.8_SETUP.exe	91
PID 3180 wrote to memory of 2620	3180	AppLaunch.exe	92
PID 3180 wrote to memory of 2620	3180	AppLaunch.exe	92
PID 3180 wrote to memory of 2620	3180	AppLaunch.exe	92
PID 4564 wrote to memory of 396	4564	bitbot_v2.8_SETUP.exe	93
PID 4564 wrote to memory of 396	4564	bitbot_v2.8_SETUP.exe	93
PID 4564 wrote to memory of 396	4564	bitbot_v2.8_SETUP.exe	93
PID 396 wrote to memory of 1428	396	wdisplay.exe	95
PID 396 wrote to memory of 1428	396	wdisplay.exe	95
PID 396 wrote to memory of 1428	396	wdisplay.exe	95
PID 1428 wrote to memory of 1440	1428	cmd.exe	97
PID 1428 wrote to memory of 1440	1428	cmd.exe	97
PID 1428 wrote to memory of 1440	1428	cmd.exe	97
PID 396 wrote to memory of 4368	396	wdisplay.exe	98
PID 396 wrote to memory of 4368	396	wdisplay.exe	98
PID 396 wrote to memory of 4368	396	wdisplay.exe	98
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4064	4368	memtest.exe	100
PID 4368 wrote to memory of 4800	4368	memtest.exe	101
PID 4368 wrote to memory of 4800	4368	memtest.exe	101
PID 4368 wrote to memory of 4800	4368	memtest.exe	101

C:\Users\Admin\AppData\Local\Temp\bitbot_v2.8_SETUP.exe
"C:\Users\Admin\AppData\Local\Temp\bitbot_v2.8_SETUP.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2620
- C:\Users\Admin\AppData\Local\Temp\wdisplay.exe
  "C:\Users\Admin\AppData\Local\Temp\wdisplay.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /d "C:\Windows\explorer.exe, C:\Users\Admin\AppData\Local\Temp\wdisplay.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /d "C:\Windows\explorer.exe, C:\Users\Admin\AppData\Local\Temp\wdisplay.exe" /f
      4⤵
      Modifies WinLogon for persistence
      System Location Discovery: System Language Discovery
      PID:1440
- - C:\Users\Admin\AppData\Local\Temp\memtest.exe
    "C:\Users\Admin\AppData\Local\Temp\memtest.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\wdisplay.exe
      "C:\Users\Admin\AppData\Local\Temp\wdisplay.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\wdisplay.exe.log

Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\memtest.exe

Filesize
394KB

MD5
83b9c0ccfc41bcf9900d13d3de74ba3b

SHA1
d2dddf0c6c5e6ce45f3ebf3d89826ed64fdab610

SHA256
32b7afcb5c386847d67df435dd1ee685d7afa39bc0fac4437f054c5546af25dd

SHA512
2181189443bda3126c4e2335d355454eee3c9576292fd9485dc75839c04cf64dc0f13c58db52f202f513d5ff342c688ca1b44f013db66d68423d22b0b5caa139

Download Submit
C:\Users\Admin\AppData\Local\Temp\wdisplay.exe

Filesize
9KB

MD5
08ab5643b6469e0563d02f25a5d45de6

SHA1
32556b524c38559de2bf31e08883ca20e20a2b66

SHA256
fc070a7f806d5ad7df330bb774d3a2708ed5576d6a113dad3f20a52e3400d7b7

SHA512
090cf8e8f9478e2dd9c9d86cec7d3be1c846903b652d2cccfb01114ce2a689403ccb2527f74fccd37fb4ef84a3ab0bf2ea84fdce1429c48e05020a8dc9a2595f

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

Filesize
57KB

MD5
454501a66ad6e85175a6757573d79f8b

SHA1
8ca96c61f26a640a5b1b1152d055260b9d43e308

SHA256
7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

SHA512
9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch

Filesize
420B

MD5
f13c44ab8e4a29fa4837d55d4b245ced

SHA1
a13279c616ad014e216b0b4136c6d8b5846fd21e

SHA256
08b2af116449dcba21ce69ccfc4759e29c51859655fe83d88ec720af01a4b727

SHA512
caf1ce7b1a0b6d277af25c87f2b9b2c2186e31ea49bdb15908beeeb8d5b3005d4acde4505198827fbb47ee08c9459c39de1c08541cb91ccc82b8f5a6a2ced17a

Download Submit
memory/396-38-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/396-39-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/396-45-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/396-41-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/396-37-0x0000000074EB2000-0x0000000074EB3000-memory.dmp

Filesize
4KB

Download
memory/3180-10-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3180-12-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3180-9-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3180-40-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3180-14-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3180-11-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3180-13-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4064-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4064-53-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4064-54-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4064-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4564-2-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/4564-3-0x0000000074EB2000-0x0000000074EB3000-memory.dmp

Filesize
4KB

Download
memory/4564-51-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/4564-4-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/4564-1-0x0000000074EB0000-0x0000000075461000-memory.dmp

Filesize
5.7MB

Download
memory/4564-0-0x0000000074EB2000-0x0000000074EB3000-memory.dmp

Filesize
4KB

Download