dcrat | 22a2d7af185892d400b7b98c62dedaf8ff9bfdf65fcc7c6c20d4ca102452db6d

Analysis

max time kernel
123s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/09/2022, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54b3ae8eec0c73f0ac6993f761a8b099.exe
Size 4.0MB
Sample220924-sdwa2abeb5
SHA256 22a2d7af185892d400b7b98c62dedaf8ff9bfdf65fcc7c6c20d4ca102452db6d
MD5 54b3ae8eec0c73f0ac6993f761a8b099
SHA1 a8ec0c7bcc845ee8bf9a017830d3d611d0e3287a
SHA512 909fd7d72e6d6aa18fef8b7dcf301716baa6f7fbef75646162d1994ab61c089eeb889412cb3d4b74fce3ad75235911570e18c94b4be65990017214388777890b
SSDEEP 49152:i6Mfs/3KxuSrb/TWvO90d7HjmAFd4A64nsfJkclgXKRQHfD/az1YLm0lhoM9iTdT:b3D68zlhZwTR0A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	520	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4424	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4424	schtasks.exe	65

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0009000000022dee-133.dat	dcrat
behavioral2/files/0x0009000000022dee-134.dat	dcrat
behavioral2/memory/1448-135-0x00000000007C0000-0x0000000000898000-memory.dmp	dcrat
behavioral2/files/0x0009000000022df7-142.dat	dcrat
behavioral2/files/0x0009000000022df7-143.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1448	go-memexec-3878489337.exe
1912	Registry.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	go-memexec-3878489337.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\54b3ae8eec0c73f0ac6993f761a8b099.exe	go-memexec-3878489337.exe
File created	C:\Program Files (x86)\WindowsPowerShell\54b3ae8eec0c73f0ac6993f761a8b099.exe	go-memexec-3878489337.exe
File created	C:\Program Files (x86)\WindowsPowerShell\bd1ef337a56b55	go-memexec-3878489337.exe
File created	C:\Program Files\Windows NT\TableTextService\go-memexec-3878489337.exe	go-memexec-3878489337.exe
File created	C:\Program Files\Windows NT\TableTextService\7761cccda1e0ac	go-memexec-3878489337.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\services.exe	go-memexec-3878489337.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\c5b4cb5e9653cc	go-memexec-3878489337.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Registration\lsass.exe	go-memexec-3878489337.exe
File created	C:\Windows\Registration\6203df4a6bafc7	go-memexec-3878489337.exe
File created	C:\Windows\IdentityCRL\INT\lsass.exe	go-memexec-3878489337.exe
File created	C:\Windows\IdentityCRL\INT\6203df4a6bafc7	go-memexec-3878489337.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3888	schtasks.exe
320	schtasks.exe
4236	schtasks.exe
2736	schtasks.exe
2824	schtasks.exe
1672	schtasks.exe
4940	schtasks.exe
4492	schtasks.exe
4132	schtasks.exe
2296	schtasks.exe
3636	schtasks.exe
4024	schtasks.exe
2636	schtasks.exe
3796	schtasks.exe
4800	schtasks.exe
4680	schtasks.exe
4644	schtasks.exe
4496	schtasks.exe
4316	schtasks.exe
3472	schtasks.exe
2008	schtasks.exe
2324	schtasks.exe
3960	schtasks.exe
520	schtasks.exe
4332	schtasks.exe
3352	schtasks.exe
2292	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	go-memexec-3878489337.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1448	go-memexec-3878489337.exe
1448	go-memexec-3878489337.exe
1448	go-memexec-3878489337.exe
1448	go-memexec-3878489337.exe
1448	go-memexec-3878489337.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe
1912	Registry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	Registry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	go-memexec-3878489337.exe
Token: SeDebugPrivilege	1912	Registry.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1448	1800	54b3ae8eec0c73f0ac6993f761a8b099.exe	80
PID 1800 wrote to memory of 1448	1800	54b3ae8eec0c73f0ac6993f761a8b099.exe	80
PID 1448 wrote to memory of 3984	1448	go-memexec-3878489337.exe	108
PID 1448 wrote to memory of 3984	1448	go-memexec-3878489337.exe	108
PID 3984 wrote to memory of 2388	3984	cmd.exe	110
PID 3984 wrote to memory of 2388	3984	cmd.exe	110
PID 3984 wrote to memory of 1912	3984	cmd.exe	111
PID 3984 wrote to memory of 1912	3984	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\54b3ae8eec0c73f0ac6993f761a8b099.exe
"C:\Users\Admin\AppData\Local\Temp\54b3ae8eec0c73f0ac6993f761a8b099.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\go-memexec-3878489337.exe
  C:\Users\Admin\AppData\Local\Temp\go-memexec-3878489337.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iZC2HVp7ET.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2388
  - - C:\Users\Default User\Registry.exe
      "C:\Users\Default User\Registry.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\IdentityCRL\INT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\IdentityCRL\INT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Registration\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "54b3ae8eec0c73f0ac6993f761a8b0995" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\54b3ae8eec0c73f0ac6993f761a8b099.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "54b3ae8eec0c73f0ac6993f761a8b099" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\54b3ae8eec0c73f0ac6993f761a8b099.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "54b3ae8eec0c73f0ac6993f761a8b0995" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\54b3ae8eec0c73f0ac6993f761a8b099.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Mozilla\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "go-memexec-3878489337g" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\go-memexec-3878489337.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "go-memexec-3878489337" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\go-memexec-3878489337.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "go-memexec-3878489337g" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\go-memexec-3878489337.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\PackageManifests\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\PackageManifests\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

go-memexec-3878489337.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-3878489337.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

go-memexec-3878489337.exe

Path C:\Users\Admin\AppData\Local\Temp\go-memexec-3878489337.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iZC2HVp7ET.bat

Path C:\Users\Admin\AppData\Local\Temp\iZC2HVp7ET.bat
Size 199B
SHA256 ceef9b0391df3ceefa68d5c6dfdd4a6d28ed902c399aaffc290e365e2609774f
MD5 6608ae380fc84612b2b3489c08fec85e
SHA1 df098a9cbc678a23ef8c98e0e3dc29321939187a
SHA512 c89320a55bafc449e7a93a3b690a92dae21bdaa5d299fe6eac932f6f57b9579c01df8d6f6b46dba0a455493042bac684a51f813ebfd2cadf7db987591924411f
MD5 SHA1 SHA512

Submit Download

Registry.exe

Path C:\Users\Default User\Registry.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.exe

Path C:\Users\Default\Registry.exe
Size 831KB
SHA256 1ca82d84d20a71004931e1abc59949b379b1fcd35037df5fdcb80148721fe8e8
MD5 b7e6718159acb8b5491bcc82a752c59a
SHA1 6bdb48af64d90b7b471f367876a5aff3e121f466
SHA512 13c53a36b8d269d32e3f8091079be07337bdad485084e688362eebe69c29a3966f0137d89f5c1f5f275ac0a8c9eca3f426a3c64001b8fd14aa0826071dd59323
SSDEEP 12288:bf0cZpEXSFE38iRVF1jv3vkYOejEnS+Jhlb1sI:Ic8XSFE3FRVF1jv38IESglb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1448-138-0x00007FFD784B0000-0x00007FFD78F71000-memory.dmp

Download

memory/1448-136-0x00007FFD784B0000-0x00007FFD78F71000-memory.dmp

Download

memory/1448-135-0x00000000007C0000-0x0000000000898000-memory.dmp

Download

memory/1912-144-0x00007FFD783F0000-0x00007FFD78EB1000-memory.dmp

Download

memory/1912-145-0x00007FFD783F0000-0x00007FFD78EB1000-memory.dmp

Download