dcrat | 24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc

Analysis

max time kernel
117s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
Size

775KB
MD5

0ed1f9cb842483e03e36cee538678ffd
SHA1

1d13a84aa671b75f66f4c7fce8339619291d4a43
SHA256

24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc
SHA512

78cb214db0ecbc532a50fc1344a138125e0031485c004e95bc21064165f9fd667fa582cd5196a6e1b4276b6dd7fa1d23dfabfe0c58b0d93fbf8e5329b064a809
SSDEEP

12288:FFg6HIZxWaga+z9e9qJeyLVqlUhqgPXdU2ypi0w8ncqXuvVw4heSNSzLz/:FIrr+h0qJeiqlGVUskcz9w4jI3b

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1684-12-0x0000000000400000-0x0000000000478000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2580	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe

Executes dropped EXE 1 IoCs

pid	Process
4072	WmiPrvSE.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\OfflineFilesConfigurationWmiProvider\WmiPrvSE.exe	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
File created	C:\Windows\SysWOW64\wbem\OfflineFilesConfigurationWmiProvider\24dbde2999530ef5fd907494bc374d663924116c	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3964 set thread context of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\ee2ad38f3d43822fe0c92830b00d06adc71395d2	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0\OfficeClickToRun.exe	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0\e6c9b481da804f07baff8eff543b0a1441069b5d	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
File created	C:\Program Files\Windows Portable Devices\Registry.exe	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1040	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1040	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1564	schtasks.exe
2460	schtasks.exe
1644	schtasks.exe
3124	schtasks.exe
3384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
2580	powershell.exe
2580	powershell.exe
1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2580	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	102
PID 3964 wrote to memory of 2580	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	102
PID 3964 wrote to memory of 2580	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	102
PID 3964 wrote to memory of 2396	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	103
PID 3964 wrote to memory of 2396	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	103
PID 3964 wrote to memory of 2396	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	103
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 3964 wrote to memory of 1684	3964	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	105
PID 1684 wrote to memory of 1564	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	108
PID 1684 wrote to memory of 1564	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	108
PID 1684 wrote to memory of 1564	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	108
PID 1684 wrote to memory of 2460	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	110
PID 1684 wrote to memory of 2460	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	110
PID 1684 wrote to memory of 2460	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	110
PID 1684 wrote to memory of 1644	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	112
PID 1684 wrote to memory of 1644	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	112
PID 1684 wrote to memory of 1644	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	112
PID 1684 wrote to memory of 3124	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	114
PID 1684 wrote to memory of 3124	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	114
PID 1684 wrote to memory of 3124	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	114
PID 1684 wrote to memory of 3384	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	116
PID 1684 wrote to memory of 3384	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	116
PID 1684 wrote to memory of 3384	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	116
PID 1684 wrote to memory of 1804	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	118
PID 1684 wrote to memory of 1804	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	118
PID 1684 wrote to memory of 1804	1684	24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe	118
PID 1804 wrote to memory of 3148	1804	cmd.exe	120
PID 1804 wrote to memory of 3148	1804	cmd.exe	120
PID 1804 wrote to memory of 3148	1804	cmd.exe	120
PID 1804 wrote to memory of 1040	1804	cmd.exe	121
PID 1804 wrote to memory of 1040	1804	cmd.exe	121
PID 1804 wrote to memory of 1040	1804	cmd.exe	121
PID 1804 wrote to memory of 4072	1804	cmd.exe	123
PID 1804 wrote to memory of 4072	1804	cmd.exe	123
PID 1804 wrote to memory of 4072	1804	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
"C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
  "C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe"
  2⤵
  PID:2396
- C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe
  "C:\Users\Admin\AppData\Local\Temp\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe"
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Documents and Settings\unsecapp.exe'" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Documents and Settings\SppExtComObj.exe'" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0\OfficeClickToRun.exe'" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider\WmiPrvSE.exe'" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PdezCDEWUv.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3148
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1040
  - - C:\Windows\SysWOW64\wbem\OfflineFilesConfigurationWmiProvider\WmiPrvSE.exe
      "C:\Windows\System32\wbem\OfflineFilesConfigurationWmiProvider\WmiPrvSE.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc.exe.log

Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdezCDEWUv.bat

Filesize
240B

MD5
262fdfb700292b55460943bcf1ab7928

SHA1
b48e921acbd3d3f5a20dff045f5a69f25da79eee

SHA256
b27ccec49e21adb9bac1df024d6ebb42e22bfe68cf4b4c70b193dfa9e9df3ad4

SHA512
7b741d14a48619f4b4090abd6c0d27354a5082c22194eaf4031adf1461b355e61e08bc71ba8b1c0d4709dc5d3cb02f7137238955b13ec5aaf508951f3c95131a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2y2foofm.e0v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SysWOW64\wbem\OfflineFilesConfigurationWmiProvider\WmiPrvSE.exe

Filesize
775KB

MD5
0ed1f9cb842483e03e36cee538678ffd

SHA1
1d13a84aa671b75f66f4c7fce8339619291d4a43

SHA256
24f719954fbcfd391426579d7f4965d2771f0d2751bed291e6a8dd26228315cc

SHA512
78cb214db0ecbc532a50fc1344a138125e0031485c004e95bc21064165f9fd667fa582cd5196a6e1b4276b6dd7fa1d23dfabfe0c58b0d93fbf8e5329b064a809

Download Submit
memory/1684-12-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1684-80-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/1684-64-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/1684-25-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/1684-18-0x00000000056D0000-0x0000000005736000-memory.dmp

Filesize
408KB

Download
memory/1684-16-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/2580-22-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/2580-38-0x0000000006C30000-0x0000000006C62000-memory.dmp

Filesize
200KB

Download
memory/2580-63-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/2580-60-0x0000000007C90000-0x0000000007C98000-memory.dmp

Filesize
32KB

Download
memory/2580-59-0x0000000007CB0000-0x0000000007CCA000-memory.dmp

Filesize
104KB

Download
memory/2580-17-0x0000000002D10000-0x0000000002D46000-memory.dmp

Filesize
216KB

Download
memory/2580-58-0x0000000007BB0000-0x0000000007BC4000-memory.dmp

Filesize
80KB

Download
memory/2580-57-0x0000000007BA0000-0x0000000007BAE000-memory.dmp

Filesize
56KB

Download
memory/2580-20-0x00000000058A0000-0x0000000005EC8000-memory.dmp

Filesize
6.2MB

Download
memory/2580-21-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/2580-19-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/2580-24-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/2580-56-0x0000000007B70000-0x0000000007B81000-memory.dmp

Filesize
68KB

Download
memory/2580-23-0x0000000005580000-0x00000000055A2000-memory.dmp

Filesize
136KB

Download
memory/2580-55-0x0000000007BF0000-0x0000000007C86000-memory.dmp

Filesize
600KB

Download
memory/2580-54-0x00000000079F0000-0x00000000079FA000-memory.dmp

Filesize
40KB

Download
memory/2580-35-0x0000000006010000-0x0000000006364000-memory.dmp

Filesize
3.3MB

Download
memory/2580-36-0x0000000006660000-0x000000000667E000-memory.dmp

Filesize
120KB

Download
memory/2580-37-0x0000000006690000-0x00000000066DC000-memory.dmp

Filesize
304KB

Download
memory/2580-52-0x0000000007FC0000-0x000000000863A000-memory.dmp

Filesize
6.5MB

Download
memory/2580-39-0x0000000070B60000-0x0000000070BAC000-memory.dmp

Filesize
304KB

Download
memory/2580-49-0x0000000006C00000-0x0000000006C1E000-memory.dmp

Filesize
120KB

Download
memory/2580-50-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/2580-51-0x0000000007660000-0x0000000007703000-memory.dmp

Filesize
652KB

Download
memory/2580-53-0x0000000007970000-0x000000000798A000-memory.dmp

Filesize
104KB

Download
memory/3964-15-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/3964-5-0x0000000005A50000-0x0000000005A5A000-memory.dmp

Filesize
40KB

Download
memory/3964-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Filesize
4KB

Download
memory/3964-6-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/3964-7-0x0000000005C80000-0x0000000005C8A000-memory.dmp

Filesize
40KB

Download
memory/3964-8-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Filesize
4KB

Download
memory/3964-11-0x0000000005EA0000-0x0000000005F20000-memory.dmp

Filesize
512KB

Download
memory/3964-9-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/3964-10-0x0000000001980000-0x0000000001A20000-memory.dmp

Filesize
640KB

Download
memory/3964-4-0x0000000005B10000-0x0000000005BAC000-memory.dmp

Filesize
624KB

Download
memory/3964-3-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/3964-2-0x0000000005F80000-0x0000000006524000-memory.dmp

Filesize
5.6MB

Download
memory/3964-1-0x0000000000F90000-0x0000000001054000-memory.dmp

Filesize
784KB

Download