Overview

overview

10

Static

static

1

d6b8c1db03...18.exe

windows7-x64

10

d6b8c1db03...18.exe

windows10-2004-x64

10

Resubmissions

08-12-2024 11:04

241208-m6n5ja1qcv 10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    08-12-2024 11:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe

  • Size

    978KB

  • MD5

    d6b8c1db03cd0f282e1718daf0dc35cf

  • SHA1

    33435de2eb5be3e242bc75d3c6722e6e1a9b866c

  • SHA256

    7849b02c1912451ca4703361443e161953750e9783ee237985db9cafaff76c04

  • SHA512

    fa8bc7754009e447c1a87bd1e8183e5138eb2a637a6a3853f546af48a3564522b634341f2ed09117048f549953010c7fc4d67a72194121e23171f5f3f8746c27

  • SSDEEP

    24576:gHmSroFu1bU2XbykgUD5G5/XjaTG5lgUChKw9NQLH:gH7k4lyzBdToG5Wj9U

Score
10/10
dcratdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceprivilege_escalationrattrojan

Malware Config

Signatures

  • DcRat 12 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Process spawned unexpected child process 11 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Windows security bypass 2 TTPs 3 IoCs
    evasiontrojan
  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 9 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 3 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe"
    1⤵
    • DcRat
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Loads dropped DLL
    • Windows security modification
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\454bdd99-72e7-42d8-a6a7-60c7091d3343\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\454bdd99-72e7-42d8-a6a7-60c7091d3343\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\454bdd99-72e7-42d8-a6a7-60c7091d3343\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Access Token Manipulation: Create Process with Token
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Users\Admin\AppData\Local\Temp\454bdd99-72e7-42d8-a6a7-60c7091d3343\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\454bdd99-72e7-42d8-a6a7-60c7091d3343\AdvancedRun.exe" /SpecialRun 4101d8 2608
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1152
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1PdlJXOkrr.bat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1340
        • C:\Windows\SysWOW64\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\system32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            5⤵
              PID:1864
          • C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe"
            4⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2024
            • C:\Users\Admin\AppData\Local\Temp\ad76edb5-f41f-44a7-a407-1f92f0ff3b50\AdvancedRun.exe
              "C:\Users\Admin\AppData\Local\Temp\ad76edb5-f41f-44a7-a407-1f92f0ff3b50\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ad76edb5-f41f-44a7-a407-1f92f0ff3b50\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Access Token Manipulation: Create Process with Token
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1440
              • C:\Users\Admin\AppData\Local\Temp\ad76edb5-f41f-44a7-a407-1f92f0ff3b50\AdvancedRun.exe
                "C:\Users\Admin\AppData\Local\Temp\ad76edb5-f41f-44a7-a407-1f92f0ff3b50\AdvancedRun.exe" /SpecialRun 4101d8 1440
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:560
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe" -Force
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1072
            • C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe"
              5⤵
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2056
              • C:\Program Files (x86)\Windows Defender\fr-FR\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe
                "C:\Program Files (x86)\Windows Defender\fr-FR\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe"
                6⤵
                • Windows security bypass
                • Executes dropped EXE
                • Loads dropped DLL
                • Windows security modification
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2188
                • C:\Users\Admin\AppData\Local\Temp\5cf6cadf-0cf2-4c4f-ba19-9f368cf26a10\AdvancedRun.exe
                  "C:\Users\Admin\AppData\Local\Temp\5cf6cadf-0cf2-4c4f-ba19-9f368cf26a10\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5cf6cadf-0cf2-4c4f-ba19-9f368cf26a10\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Access Token Manipulation: Create Process with Token
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1772
                  • C:\Users\Admin\AppData\Local\Temp\5cf6cadf-0cf2-4c4f-ba19-9f368cf26a10\AdvancedRun.exe
                    "C:\Users\Admin\AppData\Local\Temp\5cf6cadf-0cf2-4c4f-ba19-9f368cf26a10\AdvancedRun.exe" /SpecialRun 4101d8 1772
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2204
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Windows Defender\fr-FR\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe" -Force
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1600
                • C:\Program Files (x86)\Windows Defender\fr-FR\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe
                  "C:\Program Files (x86)\Windows Defender\fr-FR\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1988
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\sppsvc.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2764
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\mpssvc\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2552
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1156
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\SPInf\wininit.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1316
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\ReAgent\wininit.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1308
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Music\services.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1044
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\d6b8c1db03cd0f282e1718daf0dc35cf_JaffaCakes118.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1812
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\Idle.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1900
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Speech\System.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1536
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\Idle.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:796
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\pl-PL\smss.exe'" /rl HIGHEST /f
      1⤵
      • DcRat
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1688

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Impair Defenses

    3
    T1562

    Disable or Modify Tools

    3
    T1562.001

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1PdlJXOkrr.bat
      Filesize

      300B

      MD5

      39e6786f831dab14d07e5ddbe464a059

      SHA1

      395f61afb0b4bdb2bc2e798e39a08f797cd75d4e

      SHA256

      707c60a0ebfd2884fa885f8afb207953641d8123555abf155740bd39c4866414

      SHA512

      11fb938740ec06cf7eef6414e8ab8dd367774cc54009ce9414b1f028d121903905e233f45421959b62d9318c6bde9505279ad69abbc745526c8e05074a6cdf10

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I20ZG91OG6TH8K1AVXTX.temp
      Filesize

      7KB

      MD5

      261062452305fbfb44532c770f7cd786

      SHA1

      27b1f51ee19c7abacfc9b9cfcb2ff4255cd979b8

      SHA256

      d3c14068bfeb4ee594b0cdc2ac30090bc1a8bafc9dd4688323ffc2f7b813bb0b

      SHA512

      fbc2abd979614b7add2dd9b86959d39f58ddd94e075e602503256505889600373522ebc1bd17f7add297347261ad44272e0f1e06f037909b16c4acc637d39c59

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      e9cd4cf1cbce03e34c39b5454d5f23a8

      SHA1

      8430025928800e337a337307d97ea2023895e5bd

      SHA256

      6e61bfa00773fefad46bf80f053178021c36d2022c7e7e2a35436f053569b98f

      SHA512

      ce2dba0e2c4ec37c82f416936c09efdc47737dbae31ca3e25664e35849fd527edd44d23855f4be294f4d69eab0100ed20b1c936dc6a8adf3787c201783c1c6e6

      Download Submit

    • C:\Windows\SysWOW64\ReAgent\wininit.exe
      Filesize

      978KB

      MD5

      d6b8c1db03cd0f282e1718daf0dc35cf

      SHA1

      33435de2eb5be3e242bc75d3c6722e6e1a9b866c

      SHA256

      7849b02c1912451ca4703361443e161953750e9783ee237985db9cafaff76c04

      SHA512

      fa8bc7754009e447c1a87bd1e8183e5138eb2a637a6a3853f546af48a3564522b634341f2ed09117048f549953010c7fc4d67a72194121e23171f5f3f8746c27

      Download Submit

    • \Users\Admin\AppData\Local\Temp\454bdd99-72e7-42d8-a6a7-60c7091d3343\AdvancedRun.exe
      Filesize

      88KB

      MD5

      17fc12902f4769af3a9271eb4e2dacce

      SHA1

      9a4a1581cc3971579574f837e110f3bd6d529dab

      SHA256

      29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

      SHA512

      036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

      Download Submit

    • memory/1988-126-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2024-49-0x0000000001210000-0x000000000130A000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/2056-77-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2056-75-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2140-31-0x0000000074D20000-0x000000007540E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2140-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2140-3-0x0000000074D20000-0x000000007540E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2140-2-0x0000000004840000-0x0000000004936000-memory.dmp

      Filesize

      984KB

      Download

    • memory/2140-1-0x0000000001210000-0x000000000130A000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/2188-102-0x00000000010A0000-0x000000000119A000-memory.dmp

      Filesize

      1000KB

      Download

    • memory/2952-21-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2952-25-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2952-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2952-28-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2952-29-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2952-30-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2952-23-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download

    • memory/2952-19-0x0000000000400000-0x00000000004AC000-memory.dmp

      Filesize

      688KB

      Download