dcrat | fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chainperfnet.exe
Size 1.1MB
Sample260809-14bnbael7z
SHA256 fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e
MD5 8d94c3b91f4c437c0989338d703affc9
SHA1 8da9e1f5e0f929d74253f6c1facb3fda88a867e7
SHA512 12088116126f7a991df5461d3daec1c30961b9935ff7d2d911f9f29f110068f94506d33b095f35f1149d27d8dc7ccc891fadb8a0f6521ac3814eab01d1a6c789
SSDEEP 12288:f5h/uGl4pwiBWH+fMcwbuOHJxOpn6TKHNlYq/wpsqlohYBVpio5+KphTI+Diz6DJ:d8wiB1WHJM+KtldePVko5++DxhVEu
TLSH
T109354A117E44CE11F0091233C3EF458957B0E961AAA6E32B7DBA3B6E55123A77C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4168-1-0x0000000000590000-0x00000000006B2000-memory.dmp	dcrat
behavioral2/files/0x000d00000001c583-26.dat	dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5748	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5672	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6044	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	248	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5460	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5908	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5132	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5400	4740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	4740	schtasks.exe	89

Executes dropped EXE 7 IoCs

pid	Process
4668	csrss.exe
2112	csrss.exe
2800	Chainperfnet.exe
2012	ShellHost.exe
1968	RuntimeBroker.exe
1700	sppsvc.exe
1208	RuntimeBroker.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
460	WScript.exe
1224	WScript.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4168-8-0x0000000000FD0000-0x0000000000FDA000-memory.dmp	SmartAssembly

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\886983d96e3d3e	Chainperfnet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\ShellHost.exe	Chainperfnet.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\2a08264799fbe8	Chainperfnet.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RuntimeBroker.exe	Chainperfnet.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\9e8d7a4ca61bd9	Chainperfnet.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\sppsvc.exe	Chainperfnet.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\0a1fd5f707cd16	Chainperfnet.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe	Chainperfnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5672	schtasks.exe
4376	schtasks.exe
3296	schtasks.exe
6044	schtasks.exe
248	schtasks.exe
4824	schtasks.exe
5460	schtasks.exe
1544	schtasks.exe
3740	schtasks.exe
1980	schtasks.exe
5748	schtasks.exe
5908	schtasks.exe
1780	schtasks.exe
5400	schtasks.exe
3684	schtasks.exe
2544	schtasks.exe
3532	schtasks.exe
4236	schtasks.exe
5132	schtasks.exe
1232	schtasks.exe
1256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
4168	Chainperfnet.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	Chainperfnet.exe
Token: SeDebugPrivilege	2112	csrss.exe
Token: SeDebugPrivilege	4668	csrss.exe
Token: SeDebugPrivilege	2800	Chainperfnet.exe
Token: SeDebugPrivilege	1968	RuntimeBroker.exe
Token: SeDebugPrivilege	2012	ShellHost.exe
Token: SeDebugPrivilege	1700	sppsvc.exe
Token: SeDebugPrivilege	1208	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 1968	4168	Chainperfnet.exe	119
PID 2112 wrote to memory of 460	2112	csrss.exe	124
PID 2112 wrote to memory of 1224	2112	csrss.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Chainperfnet.exe
"C:\Users\Admin\AppData\Local\Temp\Chainperfnet.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RuntimeBroker.exe
  "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Application Data\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Application Data\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainperfnetC" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Chainperfnet.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Chainperfnet" /sc ONLOGON /tr "'C:\Users\Default User\Chainperfnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainperfnetC" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Chainperfnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\ShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre-1.8\bin\dtplugin\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\bin\dtplugin\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\bin\dtplugin\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Users\Admin\Application Data\csrss.exe
"C:\Users\Admin\Application Data\csrss.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9ff4cec-16b1-4def-811d-bb9f2d6b21c1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:460
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d942752c-50fe-4b32-974c-a066f0f727a8.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1224

C:\Users\Default User\Chainperfnet.exe
"C:\Users\Default User\Chainperfnet.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Program Files (x86)\MSBuild\Microsoft\ShellHost.exe
"C:\Program Files (x86)\MSBuild\Microsoft\ShellHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Program Files\Java\jre-1.8\bin\dtplugin\sppsvc.exe
"C:\Program Files\Java\jre-1.8\bin\dtplugin\sppsvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Users\Public\Music\RuntimeBroker.exe
"C:\Users\Public\Music\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe
Size 1.1MB
SHA256 fa245486b3fd0ed56fc169c0c57cad8b5a8390bd4e6b04765148cb5d2d8e0f2e
MD5 8d94c3b91f4c437c0989338d703affc9
SHA1 8da9e1f5e0f929d74253f6c1facb3fda88a867e7
SHA512 12088116126f7a991df5461d3daec1c30961b9935ff7d2d911f9f29f110068f94506d33b095f35f1149d27d8dc7ccc891fadb8a0f6521ac3814eab01d1a6c789
SSDEEP 12288:f5h/uGl4pwiBWH+fMcwbuOHJxOpn6TKHNlYq/wpsqlohYBVpio5+KphTI+Diz6DJ:d8wiB1WHJM+KtldePVko5++DxhVEu
TLSH
T109354A117E44CE11F0091233C3EF458957B0E961AAA6E32B7DBA3B6E55123A77C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d942752c-50fe-4b32-974c-a066f0f727a8.vbs

Path C:\Users\Admin\AppData\Local\Temp\d942752c-50fe-4b32-974c-a066f0f727a8.vbs
Size 493B
SHA256 e954484e09c24d54b342453d65a207dd17a0659f569d5a533ed644b671de2b27
MD5 14c469d10b4caa041db01ee204e65cc8
SHA1 c83e6633bec2ac2143ff0919f7c4f00259e7fca2
SHA512 b7611bb4732dc2a09ba761fc847cbeba6fca6e52aded638bbb8bbf4c9e11a05ff5c5b58cefe4fc819883f792bf9be53b830650dde3454b0ccd4cbc1d4319f848
TLSH
T129F09E0DFB05C734C901034316F684CF89AD940D3775E598AA04ECDE32515340DEA1CD
MD5 SHA1 SHA512 TLSH

Submit Download

f9ff4cec-16b1-4def-811d-bb9f2d6b21c1.vbs

Path C:\Users\Admin\AppData\Local\Temp\f9ff4cec-16b1-4def-811d-bb9f2d6b21c1.vbs
Size 717B
SHA256 05aba61aba922bbe6f3a5720ea852fcd62f021c261b51a0784cf123b93dc319e
MD5 34232968be93bd4fe450c61c53adca47
SHA1 6bb73fec66e0d13bbfd25e698fd9f4fe92c21301
SHA512 6c9a794ee72aa9048292e01e4ea7f2bef23eb2e02824d7379784d0ad1fb94232d38b65bfe0d5f0a8d5ed81a7a5e256b84734ecc60ba2aa92e174775b946ba7ce
TLSH
T10401F416BE0FF67024A1335191F545BF6DD8C41C2276FD9BBA50E46C2705E2404EC4EE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4168-11-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-15-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-5-0x0000000000F80000-0x0000000000F8E000-memory.dmp

Download

memory/4168-9-0x00000000028D0000-0x00000000028DC000-memory.dmp

Download

memory/4168-8-0x0000000000FD0000-0x0000000000FDA000-memory.dmp

Download

memory/4168-7-0x0000000000FB0000-0x0000000000FC6000-memory.dmp

Download

memory/4168-6-0x0000000000F90000-0x0000000000F98000-memory.dmp

Download

memory/4168-0-0x00007FFAA609F000-0x00007FFAA60A0000-memory.dmp

Download

memory/4168-13-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-4-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-16-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-17-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-20-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-21-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-22-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-19-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-3-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-32-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-2-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/4168-1-0x0000000000590000-0x00000000006B2000-memory.dmp

Download