Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
18/02/2025, 23:36
General
- Target 2ecf13b2ffdec170c8c741b8bc4a20c5.exe
- Size 3.5MB
- Sample250218-3llrnstm17
- SHA256 70c558209d7201e690991be17a01c6ef7f5b14775f2cfb288f0abafa43187fe2
Score
10/10
Malware Config
Signatures
- DcRat 15 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 51 IoCs
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 17 IoCs
- Checks whether UAC is enabled 1 TTPs 34 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 18 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 51 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ecf13b2ffdec170c8c741b8bc4a20c5.exe"C:\Users\Admin\AppData\Local\Temp\2ecf13b2ffdec170c8c741b8bc4a20c5.exe"1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\A8QtgkAkdHJtSX.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\7ZvVvN50EFKnm8Vgdn5X9sFuUOtSV.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\comServer.exe"C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\comServer.exe"4⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Sn3S8Ym1IJ.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\comServer.exe"C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\comServer.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\omibxcOtOT.bat"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72baa9f8-06c9-4135-86f4-fd98c9b8e3cb.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\535e4fc3-47ac-46a4-9e2a-f848654b03d2.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17f2a0d9-6aab-410b-9633-0e9334a94b9c.vbs"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5654f273-1a9e-4582-a5fd-d204740aadcf.vbs"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa56a02b-c55f-4b51-9bf4-e0f0db4be9de.vbs"17⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ccf25c5-7727-46dd-b6b8-9c7846453a71.vbs"19⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba83da4a-a8fb-471c-9d34-243cac8eff3e.vbs"21⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6009f0e9-560c-490c-8251-f20d14ddda9f.vbs"23⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16dd5548-c1b4-4fba-9d3c-378100445ffd.vbs"25⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\595889b7-19eb-41f2-bd4d-a88e2458cbc5.vbs"27⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9eed7d4-e94e-444f-b0d3-5bda1091f84e.vbs"29⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"30⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\794addd3-c088-43dd-a610-9a07bf4b9a75.vbs"31⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"32⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ec24cba-eb4d-4c49-a19b-49716d865c98.vbs"33⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"34⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce36005e-748d-4743-bb86-2e9cb456b26b.vbs"35⤵
-
C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"36⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6204f35a-703b-4f9e-a058-1dd5aca6f934.vbs"37⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0c0b458-66d9-42e9-9a04-6bb2d5ac5c78.vbs"37⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0219592-b785-46c2-b882-319b03590133.vbs"35⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\434d1579-fe17-43a4-ae2a-aa8b6bed8129.vbs"33⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d306fe67-974c-4a48-ab4e-f59baee8b285.vbs"31⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0758bc3-2b1e-4ee4-896f-2a38a22dd06c.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a81ea67a-886f-4b2a-b185-29408394f98b.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fce05b3a-3536-4cb7-88c6-f6adff5221e8.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74fecdc2-af55-4357-ba13-027c3c5ac000.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22106049-820c-4f0d-bf96-b32e468f0aa5.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b417bf78-1459-400d-8533-bfb1d34dcb0a.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e440a684-af83-41dd-accc-a69f67cdd4a6.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0f4a487-8c40-4d94-822f-64e8093a2184.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23c0bdbf-0fcf-40b3-92b1-936491e463cc.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a7446c4-dff1-44d9-bf44-fe26e1dca3d9.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a9e90bc-5fed-49c0-99f3-a94d5f2190ec.vbs"9⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\file.vbs"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\SurrogateagentwinhostSvc\JftB588kS8HFRKWqxhl.bat" "2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\de-DE\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\es-ES\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe.log
comServer.exe.log
16dd5548-c1b4-4fba-9d3c-378100445ffd.vbs
17f2a0d9-6aab-410b-9633-0e9334a94b9c.vbs
1ccf25c5-7727-46dd-b6b8-9c7846453a71.vbs
535e4fc3-47ac-46a4-9e2a-f848654b03d2.vbs
5654f273-1a9e-4582-a5fd-d204740aadcf.vbs
5a9e90bc-5fed-49c0-99f3-a94d5f2190ec.vbs
5ec24cba-eb4d-4c49-a19b-49716d865c98.vbs
6009f0e9-560c-490c-8251-f20d14ddda9f.vbs
72baa9f8-06c9-4135-86f4-fd98c9b8e3cb.vbs
794addd3-c088-43dd-a610-9a07bf4b9a75.vbs
Sn3S8Ym1IJ.bat
ba83da4a-a8fb-471c-9d34-243cac8eff3e.vbs
d9eed7d4-e94e-444f-b0d3-5bda1091f84e.vbs
fa56a02b-c55f-4b51-9bf4-e0f0db4be9de.vbs
omibxcOtOT.bat
7ZvVvN50EFKnm8Vgdn5X9sFuUOtSV.bat
A8QtgkAkdHJtSX.vbe
JftB588kS8HFRKWqxhl.bat
comServer.exe
file.vbs
memory/1760-170-0x000000001D5B0000-0x000000001D606000-memory.dmp
memory/2140-31-0x0000000002940000-0x0000000002948000-memory.dmp
memory/2140-40-0x000000001BFA0000-0x000000001C4C8000-memory.dmp
memory/2140-41-0x000000001BA70000-0x000000001BA7C000-memory.dmp
memory/2140-43-0x000000001BA90000-0x000000001BA98000-memory.dmp
memory/2140-44-0x000000001BAA0000-0x000000001BAAC000-memory.dmp
memory/2140-45-0x000000001BAB0000-0x000000001BABC000-memory.dmp
memory/2140-46-0x000000001BCC0000-0x000000001BCC8000-memory.dmp
memory/2140-47-0x000000001BCD0000-0x000000001BCDC000-memory.dmp
memory/2140-48-0x000000001BCE0000-0x000000001BCEA000-memory.dmp
memory/2140-49-0x000000001BCF0000-0x000000001BCFE000-memory.dmp
memory/2140-50-0x000000001BD00000-0x000000001BD08000-memory.dmp
memory/2140-51-0x000000001BD10000-0x000000001BD1E000-memory.dmp
memory/2140-52-0x000000001BD20000-0x000000001BD28000-memory.dmp
memory/2140-53-0x000000001BD30000-0x000000001BD3C000-memory.dmp
memory/2140-54-0x000000001BD40000-0x000000001BD48000-memory.dmp
memory/2140-55-0x000000001BE50000-0x000000001BE5A000-memory.dmp
memory/2140-56-0x000000001BD50000-0x000000001BD5C000-memory.dmp
memory/2140-42-0x000000001BA80000-0x000000001BA8C000-memory.dmp
memory/2140-39-0x000000001BA40000-0x000000001BA52000-memory.dmp
memory/2140-38-0x000000001BA30000-0x000000001BA38000-memory.dmp
memory/2140-37-0x000000001BA20000-0x000000001BA2C000-memory.dmp
memory/2140-36-0x000000001BA10000-0x000000001BA18000-memory.dmp
memory/2140-35-0x000000001B3F0000-0x000000001B3FC000-memory.dmp
memory/2140-34-0x000000001B3A0000-0x000000001B3F6000-memory.dmp
memory/2140-33-0x000000001B390000-0x000000001B39A000-memory.dmp
memory/2140-32-0x0000000002950000-0x0000000002960000-memory.dmp
memory/2140-30-0x0000000002930000-0x0000000002938000-memory.dmp
memory/2140-29-0x0000000002910000-0x0000000002926000-memory.dmp
memory/2140-28-0x0000000002900000-0x0000000002910000-memory.dmp
memory/2140-27-0x00000000028F0000-0x00000000028F8000-memory.dmp
memory/2140-26-0x000000001B340000-0x000000001B390000-memory.dmp
memory/2140-25-0x00000000028D0000-0x00000000028EC000-memory.dmp
memory/2140-24-0x00000000028C0000-0x00000000028C8000-memory.dmp
memory/2140-23-0x00000000027A0000-0x00000000027AE000-memory.dmp
memory/2140-22-0x0000000000360000-0x000000000069A000-memory.dmp