dcrat | 05a3a5b64599cc2660968b37868008bb805780f0bfae9b6147879a6461d9a3fd

Resubmissions

24-11-2022 07:55

221124-jr5l7aaa53 10

24-11-2022 07:50

221124-jprmjscg2t 10

Analysis

max time kernel
300s
max time network
305s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
24-11-2022 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe
Size

1.1MB
MD5

b478d340a787b85e086cc951d0696cb1
SHA1

563d9f1b35b4898d16aff1dccd8969299f7ab8b7
SHA256

8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95
SHA512

93c5a3010ae7bf41ad966902aeaa32e17faa0bad3e76248e2096478af5bf169f817c6914a775efc666967a425716609099be8bf69e2900613a65791e4fcd3e09
SSDEEP

24576:npe9a9aC/qF5EZNo9DzDn07bPVICwUmmHcexxnn:pwa9a9F54qH075kUmmHxx1n

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Executes dropped EXE 6 IoCs

Processes:

mnb.exefsdffc.exedfsds.exedaaca.exedllhost.exedal.exe

pid process

4108 mnb.exe
4516 fsdffc.exe
4384 dfsds.exe
1936 daaca.exe
4908 dllhost.exe
2316 dal.exe

pid	process
4108	mnb.exe
4516	fsdffc.exe
4384	dfsds.exe
1936	daaca.exe
4908	dllhost.exe
2316	dal.exe

Drops startup file 2 IoCs

Processes:

dfsds.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dotNET.lnk	dfsds.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysdll32.lnk	dfsds.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXEdfsds.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Time Manager = "C:\\ProgramData\\TimeManager.exe"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\scrss = "C:\\Users\\Admin\\AppData\\Roaming\\dotNET.lnk"	dfsds.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wininit = "C:\\Sysdll32.lnk"	dfsds.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ipinfo.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4704 1936 WerFault.exe daaca.exe

flow	ioc
13	ipinfo.io

pid	pid_target	process	target process
4704	1936	WerFault.exe	daaca.exe

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\dal.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fsdffc.exeExplorer.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fsdffc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	fsdffc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE

Modifies registry class 2 IoCs

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dfsds.exedaaca.exedllhost.exe

pid	process
4384	dfsds.exe
4384	dfsds.exe
1936	daaca.exe
1936	daaca.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe
4908	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3068 Explorer.EXE

pid	process
3068	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

dfsds.exedaaca.exeExplorer.EXEdllhost.exe

description	pid	process
Token: SeDebugPrivilege	4384	dfsds.exe
Token: SeDebugPrivilege	1936	daaca.exe
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeDebugPrivilege	4908	dllhost.exe
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exemnb.exedfsds.exedaaca.exe

description	pid	process	target process
PID 1728 wrote to memory of 4108	1728	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	mnb.exe
PID 1728 wrote to memory of 4108	1728	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	mnb.exe
PID 1728 wrote to memory of 4108	1728	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	mnb.exe
PID 4108 wrote to memory of 4516	4108	mnb.exe	fsdffc.exe
PID 4108 wrote to memory of 4516	4108	mnb.exe	fsdffc.exe
PID 4108 wrote to memory of 4516	4108	mnb.exe	fsdffc.exe
PID 4108 wrote to memory of 4384	4108	mnb.exe	dfsds.exe
PID 4108 wrote to memory of 4384	4108	mnb.exe	dfsds.exe
PID 4108 wrote to memory of 1936	4108	mnb.exe	daaca.exe
PID 4108 wrote to memory of 1936	4108	mnb.exe	daaca.exe
PID 4108 wrote to memory of 1936	4108	mnb.exe	daaca.exe
PID 4384 wrote to memory of 4908	4384	dfsds.exe	dllhost.exe
PID 4384 wrote to memory of 4908	4384	dfsds.exe	dllhost.exe
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1936 wrote to memory of 3068	1936	daaca.exe	Explorer.EXE
PID 1728 wrote to memory of 2316	1728	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	dal.exe
PID 1728 wrote to memory of 2316	1728	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	dal.exe
PID 1728 wrote to memory of 2316	1728	8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe	dal.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe
"C:\Users\Admin\AppData\Local\Temp\8d41d5131fac719cc11823fb57bef9ef1ea063dbb8f52b235a3948bece039d95.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\mnb.exe
"C:\Users\Admin\AppData\Local\Temp\mnb.exe" -s -psfghrykjrsetdrfhjryuygs
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108

C:\Users\Admin\AppData\Roaming\fsdffc.exe
"C:\Users\Admin\AppData\Roaming\fsdffc.exe"
4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4516

C:\Users\Admin\AppData\Roaming\dfsds.exe
"C:\Users\Admin\AppData\Roaming\dfsds.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384

C:\Users\Admin\AppData\Roaming\dllhost.exe
"C:\Users\Admin\AppData\Roaming\dllhost.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Users\Admin\AppData\Roaming\daaca.exe
"C:\Users\Admin\AppData\Roaming\daaca.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 248
5⤵
- Program crash
PID:4704

C:\Users\Admin\AppData\Local\Temp\dal.exe
"C:\Users\Admin\AppData\Local\Temp\dal.exe"
3⤵
- Executes dropped EXE
PID:2316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dal.exe
Filesize
35KB

MD5
69947fc31894cd78ea651768721e26fa

SHA1
8f1d431dc0e082e29b8e420df9063737c56d6600

SHA256
2e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7

SHA512
d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\dal.exe
Filesize
35KB

MD5
69947fc31894cd78ea651768721e26fa

SHA1
8f1d431dc0e082e29b8e420df9063737c56d6600

SHA256
2e16065cb223473d0891696e8bed97c240baad32d66c71a9c35b3f2faa1c02b7

SHA512
d1ebb7427a16201f827c918798e9c90a278b936846459f01ad09f4f095989792260cfab243f3a3655db2784a4a979f9badfd57462d0e7aa233f8c7f83a5fd1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mnb.exe
Filesize
1.2MB

MD5
8d44f882db1ce5ec780096bd698cadeb

SHA1
5eb4589f28d054befe40750a7c54de8a6f1bd0fa

SHA256
103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e

SHA512
f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mnb.exe
Filesize
1.2MB

MD5
8d44f882db1ce5ec780096bd698cadeb

SHA1
5eb4589f28d054befe40750a7c54de8a6f1bd0fa

SHA256
103df9101017558d967a8d246739520b7024a930319c3352278c19298ec6084e

SHA512
f97ccc467096023d704a4761c253ac73ed9bd3173cf1b7734b3cc6433e53f9e26393b30922c6836349a834ce8293c8b55c742a2be3f89cef42f5d2e8473347e7

Download Submit
C:\Users\Admin\AppData\Roaming\daaca.exe
Filesize
415KB

MD5
dda23435a7b21721ba96ae7fb9812e20

SHA1
2e179d2f38f04879d249aac505ec05e99efbe6aa

SHA256
521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6

SHA512
b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce

Download Submit
C:\Users\Admin\AppData\Roaming\daaca.exe
Filesize
415KB

MD5
dda23435a7b21721ba96ae7fb9812e20

SHA1
2e179d2f38f04879d249aac505ec05e99efbe6aa

SHA256
521729034f0ce5b2d3616d8efb8fc43202181cd8c6ff48b535b695dbcde75eb6

SHA512
b0972d4ad7f1ca9b3ff08fef2bd4f39368877233c100aa17caf7d93c0d8baa3cc390b7f6d3150af5f4e2d2f6352bbba9b51862790f53934cab1755720293b7ce

Download Submit
C:\Users\Admin\AppData\Roaming\dfsds.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\dfsds.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\dllhost.exe
Filesize
1.2MB

MD5
047af34af65efd5c6ee38eb7ad100a01

SHA1
61809e8f559b27e72a603a45a53116327845dbeb

SHA256
931972b7531ee614ff9f9403fb0612ca4e3d668c5bfbedacb9fe18e4ac312f1d

SHA512
7e0355636e5883fff7d42c78bc67973b5da4216a7b07fa94e089ff2aaa6f957356e0bc089d89dde71ba0151d3588c5713c9d15f205419cbb5abcd253beed9f4d

Download Submit
C:\Users\Admin\AppData\Roaming\fsdffc.exe
Filesize
48KB

MD5
f12bdda1f8ea3816740ba7a81df1e92e

SHA1
7e8f561c66e76868d2145029f71fd6ed8bc3dd50

SHA256
d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273

SHA512
f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb

Download Submit
C:\Users\Admin\AppData\Roaming\fsdffc.exe
Filesize
48KB

MD5
f12bdda1f8ea3816740ba7a81df1e92e

SHA1
7e8f561c66e76868d2145029f71fd6ed8bc3dd50

SHA256
d93f9e11688e7317fabcf7ea26ed573619edece0ae6520e80624705ac1dbb273

SHA512
f095f82295fda5622a0b682041d7934a1e943c652a9527d649764cbd0c0ae5d16f2a341aa95bf03383793cead97cea93c38276b6260acae431836088ff944abb

Download Submit
memory/1728-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1728-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/1936-334-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1936-239-0x0000000000000000-mapping.dmp

Download
memory/1936-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-338-0x0000000000000000-mapping.dmp

Download
memory/3068-335-0x0000000000800000-0x000000000081A000-memory.dmp

Filesize
104KB

Download
memory/3068-385-0x0000000000800000-0x000000000081A000-memory.dmp

Filesize
104KB

Download
memory/4108-159-0x0000000000000000-mapping.dmp

Download
memory/4108-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4108-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4384-297-0x0000026A5BD40000-0x0000026A5BD5E000-memory.dmp

Filesize
120KB

Download
memory/4384-283-0x0000026A74680000-0x0000026A746F6000-memory.dmp

Filesize
472KB

Download
memory/4384-244-0x0000026A5A0D0000-0x0000026A5A200000-memory.dmp

Filesize
1.2MB

Download
memory/4384-233-0x0000000000000000-mapping.dmp

Download
memory/4516-229-0x0000000000000000-mapping.dmp

Download
memory/4908-311-0x0000000000000000-mapping.dmp

Download