dcrat | 165b1c1b49febea0873894eeb6c808170943d02da8cb7fc3fffa636528b339b2

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DCRatBuild.exe
Size 1.1MB
Sample260424-2kr2maew3p
SHA256 165b1c1b49febea0873894eeb6c808170943d02da8cb7fc3fffa636528b339b2
MD5 5aa3659d8379d7df25723ec91b4c4948
SHA1 b50864141b0c726b0b4b805d2807a641c16ccf17
SHA512 f08e14eaaa724c5bc76ba2855e40fca85c03fb1f017e44f38e981f7e3c8411dfcf6554a627deced2e3000992d2040756c63d20ba8963f54fb0672a241cda8998
SSDEEP 24576:U2G/nvxW3Ww0t4bzRah02RQ530uBDduu7bcEry:UbA304bN+ROCuL+
TLSH
T16B4549017E448A12F0191633C2FF464847B9AC516AA6E32FBEB9376D55123E37D0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x001a00000002b3dd-12.dat	dcrat
behavioral2/memory/5324-14-0x00000000003C0000-0x0000000000496000-memory.dmp	dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5176	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5856	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5836	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	5084	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	5084	schtasks.exe	82

Executes dropped EXE 7 IoCs

pid	Process
5324	msChain.exe
4012	cmd.exe
2780	services.exe
1072	msChain.exe
644	Registry.exe
5320	lsass.exe
5540	cmd.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	pastebin.com
1	pastebin.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\7905950199d6cf	msChain.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\services.exe	msChain.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\services.exe	msChain.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\c5b4cb5e9653cc	msChain.exe
File created	C:\Program Files\Windows Media Player\Registry.exe	msChain.exe
File created	C:\Program Files\Windows Media Player\ee2ad38f3d4382	msChain.exe
File created	C:\Program Files\Uninstall Information\msChain.exe	msChain.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WUModels\msChain.exe	msChain.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3148	schtasks.exe
5836	schtasks.exe
4460	schtasks.exe
2712	schtasks.exe
3856	schtasks.exe
5176	schtasks.exe
4372	schtasks.exe
4084	schtasks.exe
1036	schtasks.exe
2104	schtasks.exe
1308	schtasks.exe
5856	schtasks.exe
4004	schtasks.exe
2968	schtasks.exe
3636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
5324	msChain.exe
4012	cmd.exe
5540	cmd.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5324	msChain.exe
Token: SeDebugPrivilege	4012	cmd.exe
Token: SeDebugPrivilege	2780	services.exe
Token: SeDebugPrivilege	1072	msChain.exe
Token: SeDebugPrivilege	644	Registry.exe
Token: SeDebugPrivilege	5320	lsass.exe
Token: SeDebugPrivilege	5540	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3464	4708	DCRatBuild.exe	78
PID 3464 wrote to memory of 460	3464	WScript.exe	79
PID 460 wrote to memory of 5324	460	cmd.exe	81
PID 5324 wrote to memory of 4012	5324	msChain.exe	98
PID 4012 wrote to memory of 324	4012	cmd.exe	107
PID 324 wrote to memory of 5168	324	cmd.exe	109
PID 324 wrote to memory of 5540	324	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\SurrogateRefbrokercrt\TJIPXZ1yt.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\SurrogateRefbrokercrt\jt8xO24p5NQDb5Q9aCeJAGLTHcI6x.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\SurrogateRefbrokercrt\msChain.exe
      "C:\SurrogateRefbrokercrt\msChain.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5324
    - - C:\SurrogateRefbrokercrt\cmd.exe
        
        "C:\SurrogateRefbrokercrt\cmd.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4012
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gJVLZ7RDs3.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5168
        
        C:\SurrogateRefbrokercrt\cmd.exe
        
        "C:\SurrogateRefbrokercrt\cmd.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\SurrogateRefbrokercrt\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\SurrogateRefbrokercrt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\SurrogateRefbrokercrt\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msChainm" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\msChain.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msChain" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\msChain.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msChainm" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\msChain.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Program Files\Microsoft Office 15\ClientX64\services.exe
"C:\Program Files\Microsoft Office 15\ClientX64\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Program Files\Uninstall Information\msChain.exe
"C:\Program Files\Uninstall Information\msChain.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Program Files\Windows Media Player\Registry.exe
"C:\Program Files\Windows Media Player\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Recovery\WindowsRE\lsass.exe
"C:\Recovery\WindowsRE\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TJIPXZ1yt.vbe

Path C:\SurrogateRefbrokercrt\TJIPXZ1yt.vbe
Size 227B
SHA256 936d5f829b602372e59c4573a5f994438c331663ccd053c37929f5a346690dcb
MD5 6a651bb43f9a0b8e2aa2a424c3148500
SHA1 6b4299ec860a2e7b5dc058f63b05379cd606649e
SHA512 b3b71cbecd573c0de4671a9e805a3e10e3848142a32a8f5e537d12b03b298b28e6f553528eeb536499326aee9d68063ac3993d2b2e6674fba078b3e79b981be4
TLSH
T139D023A82031A2E0CF0C8483CA82D82C2DD0AF25C6841BC3C0E4D103D24242E302E3C9
MD5 SHA1 SHA512 TLSH

Submit Download

jt8xO24p5NQDb5Q9aCeJAGLTHcI6x.bat

Path C:\SurrogateRefbrokercrt\jt8xO24p5NQDb5Q9aCeJAGLTHcI6x.bat
Size 38B
SHA256 1b75ab2792d0fed0d38d14470fd1dafd02374be28646d10cc8bfb19ff844d576
MD5 b65a6e2b419464093cc095c96f2a1110
SHA1 f798604cd9142de24773acc4fa6cead4952b4961
SHA512 d8d3b50fd0f7d63cb476e29ca88cc2a7e618424001f75d83d9d4b141defd1273c95a8c6ff7cd3cfa20b4d18551fefb9a4eb43b532df444afe0b455b8496ca9e4
MD5 SHA1 SHA512

Submit Download

msChain.exe

Path C:\SurrogateRefbrokercrt\msChain.exe
Size 827KB
SHA256 3f3e54accb490183056af560213747d3ece4f140b7e40047a7095753ccc894b2
MD5 f2a152310592363457262a142ca15851
SHA1 f3ca49f1b23a37c4dca6662b2a479c608c54d4f7
SHA512 4cf5418dd482f8abce7dc66c50caa3319638e9d76bb3fa9a9562e492db484135dce497f518bfade6fb04babf4ad63afdefa5f647529a07136a2fd947dcff4ff2
SSDEEP 12288:UbxRep5n0DYsah0DYSn+CU6tVdKzRlW5i+mRFfuBK5C91ndpM6P7bcEUi:UbzRah02RQ530uBDduu7bcEr
TLSH
T11A05F6027E44CE12F0091233C2EF454887B9995166A6E32FBDBA376E55523E77C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmd.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

msChain.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msChain.exe.log
Size 1KB
SHA256 28e57db6d7535775b5e65c90ab208c7fe392e373056db5d35e76854270ecd05d
MD5 400b532c938aca538f01c5616cf318cd
SHA1 598a59a9434e51a6416f91a4c83bd02505ecb846
SHA512 b15583323c457d389b873eb31b8e59fef450c0c0e684b0f797231e8d0abace9227b15d4e45b45f4c79ad044a28cc3d79f9f7c2a81bd38e43b0c09f07aaa95b73
TLSH
T16331AB7123B2B0D4891A3F471C2D56C813FF8329B550EE4CB998A25EE92741B5F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

gJVLZ7RDs3.bat

Path C:\Users\Admin\AppData\Local\Temp\gJVLZ7RDs3.bat
Size 197B
SHA256 4ae9c5d14a93a950ece76a8bc4a130588a5277ca67780ac14cec31cc29e292a4
MD5 bea0bfa8c9558abc19c02478e2a309ae
SHA1 8cc6dc83e8635ca167622ddd0e508668e2be454c
SHA512 c0faa0d0e7b751fdc8747f343dcc556064bab9dec9f051976e5226d1ef55d922c65e1bd5c95d75a3712d5a14814c7a132f5c92435889175b57fcda3ea71eeb2d
TLSH
T195D022029002C718088308631ACA1A8CB013288D7AC1B5A00B960C6826DB47AF29E6C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/644-66-0x00000000018C0000-0x00000000018CC000-memory.dmp

Download

memory/1036-38-0x0000025D15280000-0x0000025D1531E000-memory.dmp

Download

memory/1072-64-0x00000000017B0000-0x00000000017BC000-memory.dmp

Download

memory/1308-31-0x0000022F48B20000-0x0000022F48BBE000-memory.dmp

Download

memory/2104-27-0x0000023137790000-0x000002313782E000-memory.dmp

Download

memory/2712-19-0x0000022CC8C10000-0x0000022CC8CAE000-memory.dmp

Download

memory/2780-63-0x000000001AFE0000-0x000000001AFEC000-memory.dmp

Download

memory/2968-20-0x0000027CC06F0000-0x0000027CC078E000-memory.dmp

Download

memory/3148-26-0x000002597D000000-0x000002597D09E000-memory.dmp

Download

memory/3464-10-0x0000000001300000-0x0000000001364000-memory.dmp

Download

memory/3636-21-0x000001E918220000-0x000001E9182BE000-memory.dmp

Download

memory/3856-22-0x0000024914EE0000-0x0000024914F7E000-memory.dmp

Download

memory/4004-37-0x00000201B3DB0000-0x00000201B3E4E000-memory.dmp

Download

memory/4012-78-0x000000001C8A0000-0x000000001C976000-memory.dmp

Download

memory/4012-77-0x0000000001760000-0x000000000176C000-memory.dmp

Download

memory/4012-69-0x0000000001760000-0x000000000176C000-memory.dmp

Download

memory/4084-36-0x000001C29C4A0000-0x000001C29C53E000-memory.dmp

Download

memory/4372-30-0x00000193E0340000-0x00000193E03DE000-memory.dmp

Download

memory/4460-39-0x000001F316120000-0x000001F3161BE000-memory.dmp

Download

memory/4708-7-0x0000000001960000-0x00000000019C4000-memory.dmp

Download

memory/5176-25-0x000001FB6D4B0000-0x000001FB6D54E000-memory.dmp

Download

memory/5320-68-0x000000001C860000-0x000000001C86C000-memory.dmp

Download

memory/5324-52-0x000000001B7D0000-0x000000001B8A6000-memory.dmp

Download

memory/5324-51-0x0000000002590000-0x000000000259C000-memory.dmp

Download

memory/5324-14-0x00000000003C0000-0x0000000000496000-memory.dmp

Download

memory/5540-82-0x0000000002DF0000-0x0000000002DFC000-memory.dmp

Download

memory/5540-83-0x0000000002E40000-0x0000000002E52000-memory.dmp

Download

memory/5540-90-0x0000000002DF0000-0x0000000002DFC000-memory.dmp

Download

memory/5836-34-0x0000027E10D00000-0x0000027E10D9E000-memory.dmp

Download

memory/5856-32-0x000001E69B340000-0x000001E69B3DE000-memory.dmp

Download