Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
02/02/2024, 01:21
General
- Target b14d41ca84b9014a1d5018815202356d.exe
- Size 3.2MB
- Sample240202-bqnchschak
- SHA256 cebb491e8af42508a08b3d72e299bb73ce764dbe0697aa86d5e300ff50cfeb69
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 42 IoCs
- DCRat payload 7 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 13 IoCs
- Checks whether UAC is enabled 1 TTPs 28 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 42 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b14d41ca84b9014a1d5018815202356d.exe"C:\Users\Admin\AppData\Local\Temp\b14d41ca84b9014a1d5018815202356d.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rGhUXuzGmB.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe"C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9b8a19f-a0d2-40b3-8c1c-8d14cad0c405.vbs"4⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6b125b4-cb9f-4934-a97f-a36f5270f2ee.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4c5b19f-4a86-4513-9347-83f5b45182c8.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c26f625f-3029-4cee-b03c-5d2671aa8ee6.vbs"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b407b85e-4388-402f-80a2-33322ae08cc3.vbs"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3cdba83-60c0-4ac9-8bd3-7c0cc8d2198c.vbs"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f3e9e41-6879-43d6-baaf-a847d5d638fe.vbs"14⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d46b5ffe-2293-4cbf-bd50-00ac8298e749.vbs"16⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0dfe9db3-bbc3-4208-96e5-36ca45f257f7.vbs"18⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\496f5621-fe0c-4c42-9b97-537e4535a4a6.vbs"20⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed8eee0c-9712-44c4-a737-42a462c082d4.vbs"20⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ca9f54d-6cac-4494-870d-39f70aa3ec83.vbs"22⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0191c70f-0ef3-4a83-8a5a-687cd504209f.vbs"24⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04247926-8da8-4746-bc5f-88ae848ff7a4.vbs"26⤵
-
C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exeC:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb691293-ca1b-4507-ae6d-7b05e3935e01.vbs"28⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da14d4bd-fef3-4c19-8357-da33bb65e38f.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80d2e73d-b2c5-4459-b0bb-096a4a7a8e01.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2d16ff3-90ed-4cf9-b659-cee9e4fac849.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eac27f8a-240d-441c-ae9c-3ef170ca4912.vbs"22⤵
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9844146b-91bc-46a5-8c6a-cfc3711b814e.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15733be2-3fc9-4780-b3c4-080dac19e8a5.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82cd6b6c-bf63-46a2-ab4c-edf6b4cbe279.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c40c4317-b2e7-4e1e-bc78-edfd1f4ae3f1.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\522a2ee9-89da-44a9-a677-f4310d974c75.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16f5a7ef-d571-4bf2-80d5-068836710ca3.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46a370a7-7f2a-41ae-9f3e-59cca925cc80.vbs"6⤵
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "b14d41ca84b9014a1d5018815202356db" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "b14d41ca84b9014a1d5018815202356d" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "b14d41ca84b9014a1d5018815202356db" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\b14d41ca84b9014a1d5018815202356d.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\WDF\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\WDF\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft\WDF\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
b14d41ca84b9014a1d5018815202356d.exe
b14d41ca84b9014a1d5018815202356d.exe
b14d41ca84b9014a1d5018815202356d.exe
b14d41ca84b9014a1d5018815202356d.exe
b14d41ca84b9014a1d5018815202356d.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0191c70f-0ef3-4a83-8a5a-687cd504209f.vbs
04247926-8da8-4746-bc5f-88ae848ff7a4.vbs
0dfe9db3-bbc3-4208-96e5-36ca45f257f7.vbs
1f3e9e41-6879-43d6-baaf-a847d5d638fe.vbs
7ca9f54d-6cac-4494-870d-39f70aa3ec83.vbs
RCX4E30.tmp
__PSScriptPolicyTest_bixnq411.k0a.ps1
b407b85e-4388-402f-80a2-33322ae08cc3.vbs
c26f625f-3029-4cee-b03c-5d2671aa8ee6.vbs
c4c5b19f-4a86-4513-9347-83f5b45182c8.vbs
c9b8a19f-a0d2-40b3-8c1c-8d14cad0c405.vbs
d46b5ffe-2293-4cbf-bd50-00ac8298e749.vbs
e6b125b4-cb9f-4934-a97f-a36f5270f2ee.vbs
ed8eee0c-9712-44c4-a737-42a462c082d4.vbs
f3cdba83-60c0-4ac9-8bd3-7c0cc8d2198c.vbs
f4a23732581ca076dea91129ef3adaabd618a98f.exe
rGhUXuzGmB.bat
memory/392-223-0x000001EC29690000-0x000001EC296A0000-memory.dmp
memory/392-221-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/712-95-0x0000025573560000-0x0000025573570000-memory.dmp
memory/712-96-0x0000025573560000-0x0000025573570000-memory.dmp
memory/1200-94-0x000001886C530000-0x000001886C540000-memory.dmp
memory/1200-220-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/1280-92-0x00000205E8EB0000-0x00000205E8EC0000-memory.dmp
memory/1280-93-0x00000205E8EB0000-0x00000205E8EC0000-memory.dmp
memory/1584-166-0x0000027AB4B50000-0x0000027AB4B60000-memory.dmp
memory/1584-222-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/1608-208-0x000002E035630000-0x000002E035640000-memory.dmp
memory/1608-218-0x000002E035630000-0x000002E035640000-memory.dmp
memory/1628-99-0x00000174C0040000-0x00000174C0050000-memory.dmp
memory/1628-97-0x00000174C0040000-0x00000174C0050000-memory.dmp
memory/1628-98-0x00000174A7AA0000-0x00000174A7AC2000-memory.dmp
memory/1828-178-0x00000230BD990000-0x00000230BD9A0000-memory.dmp
memory/1828-177-0x00000230BD990000-0x00000230BD9A0000-memory.dmp
memory/1876-143-0x000002A7F6460000-0x000002A7F6470000-memory.dmp
memory/1876-134-0x000002A7F6460000-0x000002A7F6470000-memory.dmp
memory/1876-124-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/3264-290-0x0000000002A40000-0x0000000002A56000-memory.dmp
memory/3776-17-0x000000001B960000-0x000000001B96C000-memory.dmp
memory/3776-20-0x000000001BF40000-0x000000001C468000-memory.dmp
memory/3776-27-0x0000000000D80000-0x0000000000D90000-memory.dmp
memory/3776-91-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/3776-1-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/3776-2-0x0000000000D80000-0x0000000000D90000-memory.dmp
memory/3776-3-0x0000000000DC0000-0x0000000000DCE000-memory.dmp
memory/3776-4-0x0000000000DD0000-0x0000000000DDE000-memory.dmp
memory/3776-70-0x0000000000D80000-0x0000000000D90000-memory.dmp
memory/3776-29-0x000000001BB20000-0x000000001BB2E000-memory.dmp
memory/3776-35-0x000000001BCC0000-0x000000001BCCC000-memory.dmp
memory/3776-9-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/3776-32-0x000000001BC90000-0x000000001BC9C000-memory.dmp
memory/3776-8-0x00000000028E0000-0x00000000028E8000-memory.dmp
memory/3776-28-0x000000001BB10000-0x000000001BB1A000-memory.dmp
memory/3776-33-0x000000001BCA0000-0x000000001BCA8000-memory.dmp
memory/3776-26-0x0000000000D80000-0x0000000000D90000-memory.dmp
memory/3776-34-0x000000001BCB0000-0x000000001BCBA000-memory.dmp
memory/3776-25-0x000000001B9F0000-0x000000001B9F8000-memory.dmp
memory/3776-24-0x000000001B9E0000-0x000000001B9EC000-memory.dmp
memory/3776-23-0x000000001B9D0000-0x000000001B9DC000-memory.dmp
memory/3776-22-0x000000001B9C0000-0x000000001B9CC000-memory.dmp
memory/3776-21-0x000000001B9B0000-0x000000001B9BC000-memory.dmp
memory/3776-0-0x00000000002A0000-0x00000000005DC000-memory.dmp
memory/3776-18-0x000000001B970000-0x000000001B978000-memory.dmp
memory/3776-19-0x000000001B980000-0x000000001B992000-memory.dmp
memory/3776-16-0x000000001B950000-0x000000001B958000-memory.dmp
memory/3776-30-0x000000001BC70000-0x000000001BC78000-memory.dmp
memory/3776-15-0x000000001B8A0000-0x000000001B8AC000-memory.dmp
memory/3776-31-0x000000001BC80000-0x000000001BC8E000-memory.dmp
memory/3776-14-0x000000001B900000-0x000000001B956000-memory.dmp
memory/3776-12-0x000000001BA00000-0x000000001BA10000-memory.dmp
memory/3776-13-0x000000001B890000-0x000000001B89A000-memory.dmp
memory/3776-5-0x0000000002790000-0x0000000002798000-memory.dmp
memory/3776-6-0x00000000027A0000-0x00000000027BC000-memory.dmp
memory/3776-7-0x000000001B8B0000-0x000000001B900000-memory.dmp
memory/3776-10-0x000000001B860000-0x000000001B876000-memory.dmp
memory/3776-11-0x000000001B880000-0x000000001B888000-memory.dmp
memory/3896-167-0x000002EA77DE0000-0x000002EA77DF0000-memory.dmp
memory/4368-89-0x000002372FE20000-0x000002372FE30000-memory.dmp
memory/4368-87-0x00007FFF11630000-0x00007FFF120F1000-memory.dmp
memory/4368-90-0x000002372FE20000-0x000002372FE30000-memory.dmp
memory/4888-308-0x0000000001B10000-0x0000000001B26000-memory.dmp
memory/5108-185-0x000001A47DBE0000-0x000001A47DBF0000-memory.dmp
memory/5108-204-0x000001A47DBE0000-0x000001A47DBF0000-memory.dmp