Overview

overview

10

Static

static

10

DCRatBuild.exe

windows10-2004-x64

10

DCRatBuild.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    1049s
  • max time network
    1047s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    18/07/2026, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DCRatBuild.exe
  • Size 3.0MB
  • Sample260718-aej1aady2y
  • SHA256 9e8670e7ae7b4176972f239e0ae129f4d4d1ec9f74bfd8c1e5829db34eaa7998
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutiondcratinfostealerpersistencerat

Malware Config

Signatures

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file 5 IoCs
  • Executes dropped EXE 29 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • SmartAssembly .NET packer 3 IoCs

    Detects SmartAssembly .NET packer.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\blockproviderreviewmonitorDhcp\atwNWfeFsvj59KZ9zZpl3zn6p93Gp.vbe"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\blockproviderreviewmonitorDhcp\gXog2M0Qs2293nN7yDhJRZkUaV.bat" "
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\blockproviderreviewmonitorDhcp\Runtimenet.exe
          "C:\blockproviderreviewmonitorDhcp\Runtimenet.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8G1VufFvru.bat"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4892
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1020
              • C:\Program Files\7-Zip\Idle.exe
                "C:\Program Files\7-Zip\Idle.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1452
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\blockproviderreviewmonitorDhcp\spoolsv.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3628
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\blockproviderreviewmonitorDhcp\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:5052
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\blockproviderreviewmonitorDhcp\spoolsv.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2144
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1692
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3120
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2352
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Idle.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2080
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4784
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Idle.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4104
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3876
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3808
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2784
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\security\database\dwm.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3728
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3904
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:660
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Application Data\SearchHost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1616
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\SearchHost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2936
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Application Data\SearchHost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4940
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:716
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1408
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2004
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2416
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1380
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\csrss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:5088
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4968
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4832
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4324
    • C:\blockproviderreviewmonitorDhcp\spoolsv.exe
      "C:\blockproviderreviewmonitorDhcp\spoolsv.exe"
      1⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5004
    • C:\Windows\security\database\dwm.exe
      "C:\Windows\security\database\dwm.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3960
    • C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe
      "C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3896
    • C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe
      "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3176
    • C:\Recovery\WindowsRE\WUDFHost.exe
      "C:\Recovery\WindowsRE\WUDFHost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:788
    • C:\Windows\Migration\WTR\csrss.exe
      "C:\Windows\Migration\WTR\csrss.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5036
    • C:\Users\Admin\Application Data\SearchHost.exe
      "C:\Users\Admin\Application Data\SearchHost.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4452
    • C:\Program Files\7-Zip\Idle.exe
      "C:\Program Files\7-Zip\Idle.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:908
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:4344
      • C:\Windows\Migration\WTR\csrss.exe
        C:\Windows\Migration\WTR\csrss.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
      • C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3084
      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3788
      • C:\Program Files\7-Zip\Idle.exe
        "C:\Program Files\7-Zip\Idle.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3640
      • C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2144
      • C:\blockproviderreviewmonitorDhcp\spoolsv.exe
        C:\blockproviderreviewmonitorDhcp\spoolsv.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
      • C:\Windows\security\database\dwm.exe
        C:\Windows\security\database\dwm.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3296
      • C:\Users\Admin\Application Data\SearchHost.exe
        "C:\Users\Admin\Application Data\SearchHost.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1556
      • C:\Windows\Migration\WTR\csrss.exe
        C:\Windows\Migration\WTR\csrss.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5072
      • C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:652
      • C:\Recovery\WindowsRE\WUDFHost.exe
        C:\Recovery\WindowsRE\WUDFHost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1048
      • C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4604
      • C:\Windows\Migration\WTR\csrss.exe
        C:\Windows\Migration\WTR\csrss.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3184
      • C:\Program Files\7-Zip\Idle.exe
        "C:\Program Files\7-Zip\Idle.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4492
      • C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe
        "C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\sihost.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3252
      • C:\blockproviderreviewmonitorDhcp\spoolsv.exe
        C:\blockproviderreviewmonitorDhcp\spoolsv.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
      • C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe
        "C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Windows\security\database\dwm.exe
        C:\Windows\security\database\dwm.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1144

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RuntimeBroker.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
            • Size 1KB
            • SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8G1VufFvru.bat
            • Path C:\Users\Admin\AppData\Local\Temp\8G1VufFvru.bat
            • Size 196B
            • SHA256 5a925c8b1906658c1641c1577157367e144cb0d5da89efe788ccc506c75d0166
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Runtimenet.exe
            • Path C:\blockproviderreviewmonitorDhcp\Runtimenet.exe
            • Size 2.7MB
            • SHA256 ad5a8f0a70678395eee394dbe48b2508784e06f37e7a980f4bd61599d180360d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            atwNWfeFsvj59KZ9zZpl3zn6p93Gp.vbe
            • Path C:\blockproviderreviewmonitorDhcp\atwNWfeFsvj59KZ9zZpl3zn6p93Gp.vbe
            • Size 233B
            • SHA256 f3fa9d393c38f2beaf123ecbbbbab25f58f46273f56ff84905d17c3809397424
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            gXog2M0Qs2293nN7yDhJRZkUaV.bat
            • Path C:\blockproviderreviewmonitorDhcp\gXog2M0Qs2293nN7yDhJRZkUaV.bat
            • Size 50B
            • SHA256 544b931856d56ca2c9004d6903152392b0e97ae3f229a2b18e8f70306d646280
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2664-24-0x000000001D100000-0x000000001D110000-memory.dmp
            Download

            memory/2664-27-0x000000001D490000-0x000000001D49C000-memory.dmp
            Download

            memory/2664-18-0x000000001CA10000-0x000000001CA18000-memory.dmp
            Download

            memory/2664-19-0x000000001D0C0000-0x000000001D0D6000-memory.dmp
            Download

            memory/2664-21-0x000000001D0E0000-0x000000001D0F2000-memory.dmp
            Download

            memory/2664-22-0x000000001D420000-0x000000001D42C000-memory.dmp
            Download

            memory/2664-20-0x000000001CA80000-0x000000001CA88000-memory.dmp
            Download

            memory/2664-17-0x000000001D110000-0x000000001D160000-memory.dmp
            Download

            memory/2664-15-0x000000001CA00000-0x000000001CA08000-memory.dmp
            Download

            memory/2664-23-0x000000001D0F0000-0x000000001D0F8000-memory.dmp
            Download

            memory/2664-25-0x000000001D430000-0x000000001D486000-memory.dmp
            Download

            memory/2664-14-0x0000000002A10000-0x0000000002A1E000-memory.dmp
            Download

            memory/2664-26-0x000000001D480000-0x000000001D48C000-memory.dmp
            Download

            memory/2664-16-0x000000001D0A0000-0x000000001D0BC000-memory.dmp
            Download

            memory/2664-28-0x000000001D4A0000-0x000000001D4A8000-memory.dmp
            Download

            memory/2664-29-0x000000001D4B0000-0x000000001D4C2000-memory.dmp
            Download

            memory/2664-33-0x000000001D500000-0x000000001D50C000-memory.dmp
            Download

            memory/2664-32-0x000000001D4F0000-0x000000001D4F8000-memory.dmp
            Download

            memory/2664-31-0x000000001D4E0000-0x000000001D4E8000-memory.dmp
            Download

            memory/2664-30-0x000000001DA10000-0x000000001DF38000-memory.dmp
            Download

            memory/2664-13-0x00000000029F0000-0x00000000029FE000-memory.dmp
            Download

            memory/2664-12-0x0000000000500000-0x00000000007C6000-memory.dmp
            Download

            memory/5004-86-0x000000001C820000-0x000000001C830000-memory.dmp
            Download

            memory/5004-87-0x0000000000E10000-0x0000000000E20000-memory.dmp
            Download

            memory/5004-88-0x0000000000E70000-0x0000000000EBA000-memory.dmp
            Download

            memory/5004-89-0x0000000000EE0000-0x0000000000EF6000-memory.dmp
            Download

            memory/5004-92-0x0000000000E40000-0x0000000000E46000-memory.dmp
            Download

            memory/5004-93-0x0000000021D10000-0x0000000021D6E000-memory.dmp
            Download