dcrat | 4e6333e4c4cb032d90a01f0499d63346da93f702ef1bc8aa6a0b0a8cad912354

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b8b335babae9d4a73824efe54aa2148.exe
Size

1.2MB
MD5

3b8b335babae9d4a73824efe54aa2148
SHA1

ebb36ea7e8702f50272952071c18f362b0888003
SHA256

4e6333e4c4cb032d90a01f0499d63346da93f702ef1bc8aa6a0b0a8cad912354
SHA512

d110697dcfa249f71fe0b5097d83351285c3f4440d82aa39080d016e0202572b229612a2778aac34b26791aadfe0ce7c89b663ee2d2a83ef43bb7cf0c9fac83e
SSDEEP

24576:NR28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:TJaDKf4p4UD1v

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	2392	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	2392	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1728-0-0x00000000001D0000-0x000000000030A000-memory.dmp	dcrat
behavioral1/files/0x0006000000015d9b-29.dat	dcrat
behavioral1/files/0x0009000000015661-65.dat	dcrat
behavioral1/memory/1008-76-0x0000000000F00000-0x000000000103A000-memory.dmp	dcrat
behavioral1/memory/1008-77-0x000000001B200000-0x000000001B280000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1008	Idle.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\dllhost.exe	3b8b335babae9d4a73824efe54aa2148.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\5940a34987c991	3b8b335babae9d4a73824efe54aa2148.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\lsass.exe	3b8b335babae9d4a73824efe54aa2148.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\6203df4a6bafc7	3b8b335babae9d4a73824efe54aa2148.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\RCX2FE8.tmp	3b8b335babae9d4a73824efe54aa2148.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\dllhost.exe	3b8b335babae9d4a73824efe54aa2148.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RCX31EC.tmp	3b8b335babae9d4a73824efe54aa2148.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\lsass.exe	3b8b335babae9d4a73824efe54aa2148.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PolicyDefinitions\en-US\smss.exe	3b8b335babae9d4a73824efe54aa2148.exe
File created	C:\Windows\PolicyDefinitions\en-US\69ddcba757bf72	3b8b335babae9d4a73824efe54aa2148.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\RCX3661.tmp	3b8b335babae9d4a73824efe54aa2148.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\smss.exe	3b8b335babae9d4a73824efe54aa2148.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2072	schtasks.exe
2380	schtasks.exe
2440	schtasks.exe
2972	schtasks.exe
2744	schtasks.exe
2672	schtasks.exe
2900	schtasks.exe
2712	schtasks.exe
800	schtasks.exe
616	schtasks.exe
328	schtasks.exe
2980	schtasks.exe
2732	schtasks.exe
2888	schtasks.exe
2644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1728	3b8b335babae9d4a73824efe54aa2148.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe
1008	Idle.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1008	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	3b8b335babae9d4a73824efe54aa2148.exe
Token: SeDebugPrivilege	1008	Idle.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1008	1728	3b8b335babae9d4a73824efe54aa2148.exe	44
PID 1728 wrote to memory of 1008	1728	3b8b335babae9d4a73824efe54aa2148.exe	44
PID 1728 wrote to memory of 1008	1728	3b8b335babae9d4a73824efe54aa2148.exe	44
PID 1008 wrote to memory of 544	1008	Idle.exe	45
PID 1008 wrote to memory of 544	1008	Idle.exe	45
PID 1008 wrote to memory of 544	1008	Idle.exe	45
PID 1008 wrote to memory of 1180	1008	Idle.exe	46
PID 1008 wrote to memory of 1180	1008	Idle.exe	46
PID 1008 wrote to memory of 1180	1008	Idle.exe	46

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	3b8b335babae9d4a73824efe54aa2148.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b8b335babae9d4a73824efe54aa2148.exe
"C:\Users\Admin\AppData\Local\Temp\3b8b335babae9d4a73824efe54aa2148.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1728
- C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe
  "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1008
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\661c4cac-afac-43f9-a09c-31e8b2a00860.vbs"
    3⤵
    PID:544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6be7b570-71d4-4477-b6bc-05915ed4af25.vbs"
    3⤵
    PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\PolicyDefinitions\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\661c4cac-afac-43f9-a09c-31e8b2a00860.vbs

Filesize
747B

MD5
69409721663a35992982c6522eea770d

SHA1
31ba2830e99bc276bc4c6f6ec93b1ad9dcace0b3

SHA256
da469b3bbb9fcff4fa8d1f94352cb9b5062bf83ca4eb1b26f83597b95d113f85

SHA512
d6cc50534ceb5600926812add1373af1e9f3a3078db9868c5f7820fbc541721e18f2c735fa883cbd9e78567a336c7dff619c854008b8b633d7761208b3af13d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6be7b570-71d4-4477-b6bc-05915ed4af25.vbs

Filesize
523B

MD5
46dcca421a50e693f24748d4ddf9a5a0

SHA1
e5f1868d47d4f78fc3f14dc410a39832228c2fb4

SHA256
3bbf44ca6d9e8faf1b447c7049f63af510e4c7d67ae9ef5a12d2a95491e45932

SHA512
622843d1643ea11e93b0883317602f2b6dc073c3019669c2f959c2444ddf40435c44734fd352faa83058605d843295ed148a71f100c4fb256cb60d9a4b4466ba

Download Submit
C:\Windows\PolicyDefinitions\en-US\RCX3661.tmp

Filesize
1.2MB

MD5
bbd5124dbe0b4d8ebf24756acf9ca1f0

SHA1
ec97c1d53a478f521e2b20703722e49987eb59b4

SHA256
57e062a7fe7903fcc4cca6466e12aac8af23a34ccb1bdec9aa28bf02588e3a11

SHA512
ab806d1077e9be403e10acd7291c2c5b7dc18a3140bcbbdf3885be787ed9d4b32c3f0e475f2150bca4fe21e49aec7f99882414eb14c268beb6001d1f95a723d5

Download Submit
C:\Windows\PolicyDefinitions\en-US\smss.exe

Filesize
1.2MB

MD5
3b8b335babae9d4a73824efe54aa2148

SHA1
ebb36ea7e8702f50272952071c18f362b0888003

SHA256
4e6333e4c4cb032d90a01f0499d63346da93f702ef1bc8aa6a0b0a8cad912354

SHA512
d110697dcfa249f71fe0b5097d83351285c3f4440d82aa39080d016e0202572b229612a2778aac34b26791aadfe0ce7c89b663ee2d2a83ef43bb7cf0c9fac83e

Download Submit
memory/1008-88-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1008-87-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/1008-77-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1008-74-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/1008-76-0x0000000000F00000-0x000000000103A000-memory.dmp

Filesize
1.2MB

Download
memory/1728-7-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/1728-20-0x00000000009C0000-0x00000000009CC000-memory.dmp

Filesize
48KB

Download
memory/1728-11-0x0000000000720000-0x0000000000728000-memory.dmp

Filesize
32KB

Download
memory/1728-12-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/1728-13-0x0000000000740000-0x000000000074C000-memory.dmp

Filesize
48KB

Download
memory/1728-14-0x0000000000750000-0x0000000000758000-memory.dmp

Filesize
32KB

Download
memory/1728-15-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/1728-16-0x0000000000770000-0x000000000077E000-memory.dmp

Filesize
56KB

Download
memory/1728-17-0x0000000000780000-0x000000000078C000-memory.dmp

Filesize
48KB

Download
memory/1728-18-0x00000000009A0000-0x00000000009A8000-memory.dmp

Filesize
32KB

Download
memory/1728-19-0x00000000009B0000-0x00000000009BA000-memory.dmp

Filesize
40KB

Download
memory/1728-10-0x0000000000710000-0x000000000071C000-memory.dmp

Filesize
48KB

Download
memory/1728-9-0x0000000000700000-0x000000000070C000-memory.dmp

Filesize
48KB

Download
memory/1728-8-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/1728-75-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/1728-0-0x00000000001D0000-0x000000000030A000-memory.dmp

Filesize
1.2MB

Download
memory/1728-6-0x00000000005B0000-0x00000000005C6000-memory.dmp

Filesize
88KB

Download
memory/1728-5-0x0000000000330000-0x0000000000340000-memory.dmp

Filesize
64KB

Download
memory/1728-4-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/1728-3-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download
memory/1728-2-0x000000001B020000-0x000000001B0A0000-memory.dmp

Filesize
512KB

Download
memory/1728-1-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download