Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
26/09/2024, 04:36
General
- Target 21bea813ae3d796798c3ac78edc721d6.exe
- Size 3.3MB
- Sample240926-e78xbsxgmp
- SHA256 5f89b33cedfe3e9f075dd2312b10580dd16b5fb1702fe1f1ce572a792ec9bf91
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 36 IoCs
- DCRat payload 11 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Executes dropped EXE 10 IoCs
- Checks whether UAC is enabled 1 TTPs 24 IoCs
- Drops file in Program Files directory 6 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 36 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\21bea813ae3d796798c3ac78edc721d6.exe"C:\Users\Admin\AppData\Local\Temp\21bea813ae3d796798c3ac78edc721d6.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\21bea813ae3d796798c3ac78edc721d6.exe"C:\Users\Admin\AppData\Local\Temp\21bea813ae3d796798c3ac78edc721d6.exe"2⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lohe5CmuHk.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
C:\Users\Admin\SendTo\Idle.exe"C:\Users\Admin\SendTo\Idle.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ca8d6cd-543f-4422-92a4-b98fd4d10cc7.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30be4ba2-ef4b-453d-abcd-49f0daaa3820.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed52c248-2b3d-405f-b295-15bdb1052f40.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe10⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d78a053e-f1ab-4ac3-ba9e-9178e4300134.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe12⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c0c7df5-0c6c-45b9-8075-8771ed8b11e2.vbs"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe14⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ec4aa74-3b66-4e89-95b9-a4d7ea3024bc.vbs"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe16⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b58ead03-f2db-4092-97ed-19da46e8fb32.vbs"17⤵
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe18⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\887f00a7-dbd8-48b1-97a7-4a5f761ce000.vbs"19⤵
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe20⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d40fb5e6-3ee9-43da-975b-51f892adea8b.vbs"21⤵
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe22⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8155100-43da-4b01-a2e6-e05004ca6eaa.vbs"23⤵
-
C:\Users\Admin\SendTo\Idle.exeC:\Users\Admin\SendTo\Idle.exe24⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67eda3a5-3600-4e88-8187-8c49ca8c6ff6.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4788e7d7-4324-45a4-9be2-dcb41b133d42.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab4efeb1-8951-4606-bcc5-2692ef5d12cf.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32aa789c-7471-4e88-bf26-50393dca576e.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83c07fec-f9fa-41f1-a92c-1f8c1cc4f43c.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ffc65a9-e294-4fb3-9b6a-aceb462f3530.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d79fb3c-00fd-447f-81ea-d84206aa030a.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\839fd9e4-31f2-4096-b29d-bf7028c752de.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2fdca83-79f9-4537-92e2-519e275ccbd4.vbs"7⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4299ca25-82e5-4347-b988-5c4eb4edcf42.vbs"5⤵
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\MSBuild\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Windows\twain_32\OSPPSVC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\twain_32\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Windows\twain_32\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\SendTo\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre7\bin\plugin2\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\plugin2\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre7\bin\plugin2\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
lsm.exe
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
2ec4aa74-3b66-4e89-95b9-a4d7ea3024bc.vbs
30be4ba2-ef4b-453d-abcd-49f0daaa3820.vbs
4299ca25-82e5-4347-b988-5c4eb4edcf42.vbs
7c0c7df5-0c6c-45b9-8075-8771ed8b11e2.vbs
887f00a7-dbd8-48b1-97a7-4a5f761ce000.vbs
9ca8d6cd-543f-4422-92a4-b98fd4d10cc7.vbs
CabFAA6.tmp
Lohe5CmuHk.bat
TarFAC8.tmp
b58ead03-f2db-4092-97ed-19da46e8fb32.vbs
d40fb5e6-3ee9-43da-975b-51f892adea8b.vbs
d78a053e-f1ab-4ac3-ba9e-9178e4300134.vbs
df41e41c2e72622854ba75fa0ea30c8458a4e2b14.5.32e78a08773b69606fecef4c66a456055fdf150977
ed52c248-2b3d-405f-b295-15bdb1052f40.vbs
f8155100-43da-4b01-a2e6-e05004ca6eaa.vbs
Idle.exe
memory/1452-907-0x0000000000BB0000-0x0000000000BC2000-memory.dmp
memory/1712-788-0x0000000000380000-0x0000000000392000-memory.dmp
memory/1712-787-0x0000000000BC0000-0x0000000000F1A000-memory.dmp
memory/1724-309-0x0000000000850000-0x0000000000862000-memory.dmp
memory/1724-308-0x0000000000170000-0x00000000004CA000-memory.dmp
memory/1848-72-0x0000000001180000-0x00000000014DA000-memory.dmp
memory/2144-429-0x0000000002390000-0x00000000023A2000-memory.dmp
memory/2144-428-0x0000000000860000-0x0000000000BBA000-memory.dmp
memory/2260-1027-0x0000000002470000-0x0000000002482000-memory.dmp
memory/2260-1026-0x00000000001F0000-0x000000000054A000-memory.dmp
memory/2676-189-0x000000001AA10000-0x000000001AA22000-memory.dmp
memory/2696-20-0x0000000000DD0000-0x0000000000DD8000-memory.dmp
memory/2696-11-0x0000000000510000-0x0000000000522000-memory.dmp
memory/2696-0-0x000007FEF6543000-0x000007FEF6544000-memory.dmp
memory/2696-21-0x0000000000DE0000-0x0000000000DF2000-memory.dmp
memory/2696-46-0x000007FEF6540000-0x000007FEF6F2C000-memory.dmp
memory/2696-36-0x0000000000FB0000-0x0000000000FBC000-memory.dmp
memory/2696-19-0x0000000000C30000-0x0000000000C3C000-memory.dmp
memory/2696-18-0x00000000005A0000-0x00000000005A8000-memory.dmp
memory/2696-17-0x0000000000590000-0x000000000059C000-memory.dmp
memory/2696-35-0x0000000000FA0000-0x0000000000FAA000-memory.dmp
memory/2696-16-0x0000000000540000-0x0000000000596000-memory.dmp
memory/2696-15-0x0000000000530000-0x000000000053A000-memory.dmp
memory/2696-34-0x0000000000F90000-0x0000000000F98000-memory.dmp
memory/2696-23-0x0000000000E60000-0x0000000000E6C000-memory.dmp
memory/2696-29-0x0000000000F40000-0x0000000000F4A000-memory.dmp
memory/2696-14-0x0000000000520000-0x0000000000530000-memory.dmp
memory/2696-30-0x0000000000F50000-0x0000000000F5E000-memory.dmp
memory/2696-32-0x0000000000F70000-0x0000000000F78000-memory.dmp
memory/2696-13-0x00000000004F0000-0x00000000004F8000-memory.dmp
memory/2696-12-0x0000000000500000-0x000000000050C000-memory.dmp
memory/2696-24-0x0000000000EF0000-0x0000000000EF8000-memory.dmp
memory/2696-22-0x0000000000E10000-0x0000000000E1C000-memory.dmp
memory/2696-10-0x00000000004D0000-0x00000000004D8000-memory.dmp
memory/2696-1-0x0000000001350000-0x00000000016AA000-memory.dmp
memory/2696-25-0x0000000000F00000-0x0000000000F0C000-memory.dmp
memory/2696-9-0x00000000004B0000-0x00000000004C6000-memory.dmp
memory/2696-8-0x0000000000320000-0x0000000000330000-memory.dmp
memory/2696-28-0x0000000000F30000-0x0000000000F3C000-memory.dmp
memory/2696-27-0x0000000000F20000-0x0000000000F28000-memory.dmp
memory/2696-7-0x0000000000310000-0x0000000000318000-memory.dmp
memory/2696-6-0x00000000002F0000-0x000000000030C000-memory.dmp
memory/2696-26-0x0000000000F10000-0x0000000000F1C000-memory.dmp
memory/2696-5-0x00000000002E0000-0x00000000002E8000-memory.dmp
memory/2696-4-0x0000000000160000-0x000000000016E000-memory.dmp
memory/2696-33-0x0000000000F80000-0x0000000000F8C000-memory.dmp
memory/2696-31-0x0000000000F60000-0x0000000000F68000-memory.dmp
memory/2696-3-0x0000000000150000-0x000000000015E000-memory.dmp
memory/2696-2-0x000007FEF6540000-0x000007FEF6F2C000-memory.dmp
memory/2804-1146-0x0000000000260000-0x00000000005BA000-memory.dmp
memory/2856-668-0x0000000002360000-0x0000000002372000-memory.dmp
memory/2856-667-0x0000000000240000-0x000000000059A000-memory.dmp
memory/3056-548-0x0000000000CA0000-0x0000000000FFA000-memory.dmp