dcrat | cab29c9ab55e8abba46f02e6002a5f34169ed7b8b370280011cd44eb5475bb3d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
Size 1.9MB
Sample240605-cldsysbh96
SHA256 cab29c9ab55e8abba46f02e6002a5f34169ed7b8b370280011cd44eb5475bb3d
MD5 2a4c4774b3dc169e1bcd80dcba50c680
SHA1 0c83656b967256f1732a5cf09a6ea97f74e1eb81
SHA512 298fbadd09162f18dced5f605b00b1fdee93b41e6834f65ae580682e7c63a7d3267f082d2b2084cb609fb71f65fd679dcaca363d27eb4bafb06d4cb08e61eee6
SSDEEP 24576:5cIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:XrhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\""	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\spoolsv.exe\""	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2604	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2604	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2604	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2604	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2604	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2604	schtasks.exe	28

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2796-1-0x00000000009E0000-0x0000000000BDA000-memory.dmp	dcrat
behavioral1/files/0x000c00000001444f-32.dat	dcrat
behavioral1/memory/2120-66-0x00000000001E0000-0x00000000003DA000-memory.dmp	dcrat
behavioral1/files/0x0007000000015cb9-65.dat	dcrat
behavioral1/files/0x0007000000015cb9-64.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
1636	powershell.exe
764	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2120	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\spoolsv.exe\""	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\""	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\Idle.exe\""	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\spoolsv.exe\""	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\f3b6ecef712a24	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCX1E9A.tmp	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
File opened for modification	C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
File created	C:\Windows\security\ApplicationId\PolicyManagement\6ccacd8608530f	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
File opened for modification	C:\Windows\security\ApplicationId\PolicyManagement\RCX1C96.tmp	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2804	schtasks.exe
2492	schtasks.exe
2464	schtasks.exe
2620	schtasks.exe
2476	schtasks.exe
2484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
2404	powershell.exe
1636	powershell.exe
764	powershell.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe
2120	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	2120	spoolsv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2404	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	35
PID 2796 wrote to memory of 2404	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	35
PID 2796 wrote to memory of 2404	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	35
PID 2796 wrote to memory of 764	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	36
PID 2796 wrote to memory of 764	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	36
PID 2796 wrote to memory of 764	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	36
PID 2796 wrote to memory of 1636	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	37
PID 2796 wrote to memory of 1636	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	37
PID 2796 wrote to memory of 1636	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	37
PID 2796 wrote to memory of 2884	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	41
PID 2796 wrote to memory of 2884	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	41
PID 2796 wrote to memory of 2884	2796	2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe	41
PID 2884 wrote to memory of 1628	2884	cmd.exe	43
PID 2884 wrote to memory of 1628	2884	cmd.exe	43
PID 2884 wrote to memory of 1628	2884	cmd.exe	43
PID 2884 wrote to memory of 2120	2884	cmd.exe	44
PID 2884 wrote to memory of 2120	2884	cmd.exe	44
PID 2884 wrote to memory of 2120	2884	cmd.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2a4c4774b3dc169e1bcd80dcba50c680_NeikiAnalytics.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B2zC3mwCkt.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1628
- - C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe
    "C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv.exe

Path C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe
Size 1.7MB
SHA256 6e1cdb3636837e916055dd7de57ab29b9d3f0e2fd150bed47e57cb43fc9ce578
MD5 48a9d5f85d2cf986c91b726811d134e1
SHA1 0ab1df7788dbf7d2362729027cd25967a92b58ca
SHA512 a8cd2a6949835bb9fa98e4877e51d4e125ecaccaf65c502a28eaa4c61d1b9c94b151e541ed657b0a719dd1d4e5574f8001b65eda6a57d4561704277bcf9ef1d0
SSDEEP 24576:5cIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6Mnc:XrhDbJ4dAlkpuuUpY57cKEr0a7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Program Files\Microsoft Office\Office14\1033\spoolsv.exe
Size 448KB
SHA256 b2c29957a411c89dc3b12fbf7eb61ddba5b374ca5af1b51b8a7f6fcabd1d9cfd
MD5 e4b8c04846b0a4c79d6bb9da6f7fcfb5
SHA1 88534595914df9695e55a79c93eeaf0b84ecd894
SHA512 f874282257432c534164fb257f395275897495167921ada823695f4184f989c42f0a9a9742e258e3ceda6fb2c4bab3a992f03e10be8cd46b2055b4ae2fa95d1a
SSDEEP 6144:5KdCUo52V3dcgMSSvqRg3RwPizA05sM3rzMtabHg8KmYIp:5+lYkcnDeg3sizpbvr9YIp
MD5 SHA1 SHA512 SSDEEP

Submit Download

B2zC3mwCkt.bat

Path C:\Users\Admin\AppData\Local\Temp\B2zC3mwCkt.bat
Size 224B
SHA256 5dd6c2bcf5262780a934203e459d462c6f193faecb7393e350d44477b7275c6e
MD5 ecc1b84f58058153ac2806272f6299ca
SHA1 996dd3270d00af717755e19dc133091fffa94c6f
SHA512 37708713452763edbb5749ceda40437f6082288a32d02b5667810503a8a780e00c4ff86b2f3897fe6593a4ed87ab8d9fb30f3db7f18e5cd7717798d4c4c75886
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 9e3a14fb5317fa6aaf48c44029594afd9b5bd6726e71b8135001a60213518980
MD5 736ae16d9f7edc0c17681fcfd436b306
SHA1 ee3f01c144eca166f97213553b43ace040459d12
SHA512 0df1d390f2c7520691a54ffd88c295e7c877b1320f8e811c157749dc4b682369355ba0b992f34651f8848e3542529d7a6d7a633e3612ec1ee29d0c3a47e4386f
SSDEEP 96:YAqqCZM8LnqvsqvJCwoBAqqCZM8LnqvsEHyqvJCworol5EQHNS7qVXlUVs:obXUofbXAHnoroYAS7qVr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe

Path C:\Windows\security\ApplicationId\PolicyManagement\Idle.exe
Size 1.9MB
SHA256 cab29c9ab55e8abba46f02e6002a5f34169ed7b8b370280011cd44eb5475bb3d
MD5 2a4c4774b3dc169e1bcd80dcba50c680
SHA1 0c83656b967256f1732a5cf09a6ea97f74e1eb81
SHA512 298fbadd09162f18dced5f605b00b1fdee93b41e6834f65ae580682e7c63a7d3267f082d2b2084cb609fb71f65fd679dcaca363d27eb4bafb06d4cb08e61eee6
SSDEEP 24576:5cIqg3pZ9Lbp1x5mMnbJ4ANfUAlkDd/2uUpET57RLGKETv/cyUM6MniOlsxvZBSg:XrhDbJ4dAlkpuuUpY57cKEr0a7iOyKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2120-66-0x00000000001E0000-0x00000000003DA000-memory.dmp

Download

memory/2404-62-0x000000001B650000-0x000000001B932000-memory.dmp

Download

memory/2404-63-0x0000000001F60000-0x0000000001F68000-memory.dmp

Download

memory/2796-19-0x000000001A8A0000-0x000000001A8AA000-memory.dmp

Download

memory/2796-11-0x00000000023A0000-0x00000000023AC000-memory.dmp

Download

memory/2796-18-0x000000001A890000-0x000000001A89C000-memory.dmp

Download

memory/2796-17-0x000000001A880000-0x000000001A88E000-memory.dmp

Download

memory/2796-21-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Download

memory/2796-20-0x000000001A8B0000-0x000000001A8BC000-memory.dmp

Download

memory/2796-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Download

memory/2796-16-0x000000001A870000-0x000000001A878000-memory.dmp

Download

memory/2796-15-0x00000000023E0000-0x00000000023EE000-memory.dmp

Download

memory/2796-13-0x00000000023C0000-0x00000000023C8000-memory.dmp

Download

memory/2796-12-0x00000000023B0000-0x00000000023BC000-memory.dmp

Download

memory/2796-14-0x00000000023D0000-0x00000000023DC000-memory.dmp

Download

memory/2796-9-0x0000000002360000-0x000000000236C000-memory.dmp

Download

memory/2796-7-0x00000000009C0000-0x00000000009D6000-memory.dmp

Download

memory/2796-6-0x00000000009B0000-0x00000000009C0000-memory.dmp

Download

memory/2796-10-0x0000000002370000-0x0000000002382000-memory.dmp

Download

memory/2796-8-0x0000000002350000-0x0000000002360000-memory.dmp

Download

memory/2796-4-0x0000000000980000-0x0000000000988000-memory.dmp

Download

memory/2796-61-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Download

memory/2796-5-0x0000000000990000-0x00000000009AC000-memory.dmp

Download

memory/2796-3-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/2796-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Download

memory/2796-1-0x00000000009E0000-0x0000000000BDA000-memory.dmp

Download