Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
11/06/2024, 13:29
General
- Target 3658fc827345de2dee98578f0f611c40_NeikiAnalytics.exe
- Size 1.9MB
- Sample240611-qrffmayfnl
- SHA256 fa1fc6499091995417908eb011a6b43fd6eca9b9d43cead32c2137381f860200
Score
10/10
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 48 IoCs
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 15 IoCs
- Checks whether UAC is enabled 1 TTPs 32 IoCs
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 16 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 48 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3658fc827345de2dee98578f0f611c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3658fc827345de2dee98578f0f611c40_NeikiAnalytics.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SqGJyhfLcw.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d23c0e0-451b-423b-a68e-90ed3b5dc189.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc9d740b-11d5-4031-8ddc-c975dd5651a1.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f280c24-f024-4992-8e47-8433b5e8c39f.vbs"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09140128-10fe-4d19-aeb3-1e5679be2b0f.vbs"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52080597-9455-465d-ac63-977a31182f3d.vbs"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33e6c858-c2b9-4db8-a601-f25ce39d0b3b.vbs"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d1587fd-04bc-4030-9960-72bd30f9ea63.vbs"16⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b876a3a9-4d10-43ac-ad0c-ed4a24391f39.vbs"18⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da6f9b3e-f77f-4a10-8eab-6a4ef4f4c449.vbs"20⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a83dfed-e957-4c95-8f48-aeb48b26cd2d.vbs"22⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5af9396b-7582-4a39-8b3b-222b171878eb.vbs"24⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c49121e-6302-4cc2-832f-99586b27d340.vbs"26⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19336296-47e0-4d90-b0ee-842380588291.vbs"28⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"29⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c66a30e-0bb8-4a8c-862d-356a42e71799.vbs"30⤵
-
C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe"31⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d41df95f-dc14-4250-8b26-64e5af7c53d0.vbs"32⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d1c649e-f8db-4389-bedf-e25d0e1909db.vbs"32⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3a21381-5937-472d-ada2-f4eedd06dfee.vbs"30⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9428bb74-f14c-428b-89f1-208b5d2915cb.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e5532ba-2fd8-443f-a786-858f3a16cd0f.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91bdb325-34bd-4ec9-b959-1f0d9f7b385b.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d617f09-f82d-43f1-8cf3-caefe270e30c.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73854e75-3fce-4e43-af15-7475f4189b13.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19f16de7-5be4-414d-9d68-d367dd60525f.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bef77442-de53-4557-8326-97967a114abc.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc679bb1-2853-4dbf-b1ff-c4ae936ea2ef.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec501af1-aa97-41d8-92db-0f3ad6c8fdef.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e16e337-36ae-4e92-a297-ff2dbc12210c.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1b2c53e-86b6-4575-b9f5-bac718756c9e.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3d46e9d-eaa2-4110-88ce-cb207fd75879.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1242c335-bf4b-42b8-a4c8-a006898adf11.vbs"4⤵
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
lsass.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
09140128-10fe-4d19-aeb3-1e5679be2b0f.vbs
1242c335-bf4b-42b8-a4c8-a006898adf11.vbs
19336296-47e0-4d90-b0ee-842380588291.vbs
2f280c24-f024-4992-8e47-8433b5e8c39f.vbs
33e6c858-c2b9-4db8-a601-f25ce39d0b3b.vbs
3d23c0e0-451b-423b-a68e-90ed3b5dc189.vbs
52080597-9455-465d-ac63-977a31182f3d.vbs
5a83dfed-e957-4c95-8f48-aeb48b26cd2d.vbs
5af9396b-7582-4a39-8b3b-222b171878eb.vbs
6c49121e-6302-4cc2-832f-99586b27d340.vbs
7d1587fd-04bc-4030-9960-72bd30f9ea63.vbs
SqGJyhfLcw.bat
__PSScriptPolicyTest_10i5eoxf.lyh.ps1
b876a3a9-4d10-43ac-ad0c-ed4a24391f39.vbs
da6f9b3e-f77f-4a10-8eab-6a4ef4f4c449.vbs
dc9d740b-11d5-4031-8ddc-c975dd5651a1.vbs
lsass.exe
memory/4396-70-0x00000255DC130000-0x00000255DC152000-memory.dmp
memory/4956-17-0x000000001C010000-0x000000001C01E000-memory.dmp
memory/4956-3-0x0000000002C40000-0x0000000002C4E000-memory.dmp
memory/4956-0-0x00000000009E0000-0x0000000000BC8000-memory.dmp
memory/4956-72-0x00007FFA34030000-0x00007FFA34AF1000-memory.dmp
memory/4956-21-0x000000001C1A0000-0x000000001C1AA000-memory.dmp
memory/4956-23-0x000000001C1B0000-0x000000001C1BC000-memory.dmp
memory/4956-22-0x00007FFA34030000-0x00007FFA34AF1000-memory.dmp
memory/4956-13-0x000000001B780000-0x000000001B78C000-memory.dmp
memory/4956-14-0x000000001BEF0000-0x000000001BEFC000-memory.dmp
memory/4956-15-0x000000001C150000-0x000000001C158000-memory.dmp
memory/4956-16-0x000000001C000000-0x000000001C00A000-memory.dmp
memory/4956-18-0x000000001C020000-0x000000001C02E000-memory.dmp
memory/4956-26-0x00007FFA34030000-0x00007FFA34AF1000-memory.dmp
memory/4956-20-0x000000001C140000-0x000000001C148000-memory.dmp
memory/4956-19-0x000000001C130000-0x000000001C13C000-memory.dmp
memory/4956-12-0x000000001B770000-0x000000001B77C000-memory.dmp
memory/4956-11-0x000000001B750000-0x000000001B75A000-memory.dmp
memory/4956-6-0x0000000002C50000-0x0000000002C60000-memory.dmp
memory/4956-7-0x000000001B710000-0x000000001B726000-memory.dmp
memory/4956-10-0x000000001B740000-0x000000001B750000-memory.dmp
memory/4956-9-0x000000001B760000-0x000000001B768000-memory.dmp
memory/4956-8-0x000000001B730000-0x000000001B738000-memory.dmp
memory/4956-5-0x000000001BEA0000-0x000000001BEF0000-memory.dmp
memory/4956-4-0x000000001B6F0000-0x000000001B70C000-memory.dmp
memory/4956-27-0x00007FFA34030000-0x00007FFA34AF1000-memory.dmp
memory/4956-2-0x00007FFA34030000-0x00007FFA34AF1000-memory.dmp
memory/4956-1-0x00007FFA34033000-0x00007FFA34035000-memory.dmp