Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 08:09

General

  • Target

    c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe

  • Size

    2.0MB

  • MD5

    c4dd0b6efb900035ac550ea40274b180

  • SHA1

    6b286cc85750702c1721a3f7eac27d7cc2548a2d

  • SHA256

    cd2c3823df758fbfab481d70c7aa63a3252300e6527893fccc99b888acfbda40

  • SHA512

    b26fe5a9067f40e484add6ea5668bd6879e4cedba3935b0f3f3a848cb318cab4f7323dc06978851f261c48a5923fe2e78da94c3f4c0cf9a010556b17762ce6f7

  • SSDEEP

    24576:Un2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:CaTUv0jmtEttc

Malware Config

Signatures

  • DcRat 50 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 30 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\explorer.exe
      "C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\explorer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2292
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\spoolsv.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2720
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2740
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2652
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2764
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2788
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2544
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\explorer.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2360
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\explorer.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2552
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\explorer.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2512
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2584
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2984
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\Sample Videos\csrss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1296
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:284
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\Sample Videos\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2820
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\dwm.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2808
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\dwm.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2240
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\dwm.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2016
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\inf\es-ES\winlogon.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1264
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\inf\es-ES\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1308
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\inf\es-ES\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1232
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalyticsc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2000
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2232
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalyticsc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2932
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\it-IT\smss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1056
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\it-IT\smss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2548
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\it-IT\smss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:316
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\winlogon.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:296
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3044
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2988
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalyticsc" /sc MINUTE /mo 11 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:292
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics" /sc ONLOGON /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:2308
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalyticsc" /sc MINUTE /mo 5 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1908
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1560
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:484
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:636
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalyticsc" /sc MINUTE /mo 13 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1492
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics" /sc ONLOGON /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1484
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "c4dd0b6efb900035ac550ea40274b180_NeikiAnalyticsc" /sc MINUTE /mo 6 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\c4dd0b6efb900035ac550ea40274b180_NeikiAnalytics.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1856
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\NetHood\csrss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:556
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\NetHood\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1312
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\NetHood\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1080
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\sppsvc.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:3040
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:684
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1556
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:940
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:772
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Creates scheduled task(s)
    PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\taskhost.exe

    Filesize

    2.0MB

    MD5

    0ec289702082e9950bd93759aef96586

    SHA1

    ab1ec5f52a6f48084798c65797bb046896d0325b

    SHA256

    49aa78bd1d54833904cd7d6ce70edb3454a76d0495487bdaebb7566bec40c7c5

    SHA512

    e92123d066669aba11292980a2e80d5914b18aafef4f83c0cbf64c523d356c2dd69c110bc7b0572a8110b0c015deebe54a2950fb5cfcb7778184e08711ca64b8

  • C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\csrss.exe

    Filesize

    2.0MB

    MD5

    f0b47eaccc1bf880672a14d3fefbd39d

    SHA1

    4af307e39e5d775e09e2ab7bae90eec204025d52

    SHA256

    b6af629f87b39e767dc9dc9b061a3365a5a465704cf8d8455119268ae332d869

    SHA512

    43784c4ddb0394525e1a1cadda1a41de45ac9a5e438d81bbbd8eaa696015ceb45f8f67845a5571b18bbb60d761fd067eebe8ba67d7b4879a6f201ecf9908720f

  • C:\Users\Public\Videos\Sample Videos\csrss.exe

    Filesize

    2.0MB

    MD5

    c4dd0b6efb900035ac550ea40274b180

    SHA1

    6b286cc85750702c1721a3f7eac27d7cc2548a2d

    SHA256

    cd2c3823df758fbfab481d70c7aa63a3252300e6527893fccc99b888acfbda40

    SHA512

    b26fe5a9067f40e484add6ea5668bd6879e4cedba3935b0f3f3a848cb318cab4f7323dc06978851f261c48a5923fe2e78da94c3f4c0cf9a010556b17762ce6f7

  • C:\Users\Public\Videos\Sample Videos\csrss.exe

    Filesize

    2.0MB

    MD5

    7d5c8616ccf2a54cf520d9234d1251f8

    SHA1

    ca1233e619e4872f6061dc5a83ec00de9bb46a9e

    SHA256

    b7780878408494df4d4b1bea1c26e421a3b55cf4c028a65375ddfa6642c09ceb

    SHA512

    abcc22ba3827b5dae8aa2f873e2a2616c3acba8b0f243a1d06010a3523c11060f206d67c7d13a17c8825d5e4f30126eedbb3aa7597e66c7563c15bd414600839

  • C:\Windows\it-IT\smss.exe

    Filesize

    2.0MB

    MD5

    57fbbc5da63490b3873b30c8b10a82e9

    SHA1

    1b01bd5ebc83867e93e96da5664adb328dbd5b55

    SHA256

    138c1d6195e13b7ea2f3e97eb4988c29f444346d55e88bc5c6ee4bb2fc56c6cd

    SHA512

    d8a94f8042d31644ccb37c337878e4f31e3ef9e833e025bcfd6da7f9bd69a3b075542dcc59e9d5bd3c6bd20dcb1af7286f71dbf20a6f4c97e59907fe5aea7c9f

  • memory/2292-236-0x00000000004A0000-0x00000000004F6000-memory.dmp

    Filesize

    344KB

  • memory/2292-234-0x0000000001030000-0x000000000123C000-memory.dmp

    Filesize

    2.0MB

  • memory/2420-5-0x0000000000460000-0x0000000000470000-memory.dmp

    Filesize

    64KB

  • memory/2420-7-0x00000000004E0000-0x0000000000536000-memory.dmp

    Filesize

    344KB

  • memory/2420-9-0x00000000005C0000-0x00000000005CC000-memory.dmp

    Filesize

    48KB

  • memory/2420-10-0x00000000005D0000-0x00000000005DC000-memory.dmp

    Filesize

    48KB

  • memory/2420-11-0x00000000005E0000-0x00000000005EE000-memory.dmp

    Filesize

    56KB

  • memory/2420-12-0x00000000005F0000-0x00000000005FE000-memory.dmp

    Filesize

    56KB

  • memory/2420-13-0x0000000000600000-0x000000000060A000-memory.dmp

    Filesize

    40KB

  • memory/2420-8-0x00000000005B0000-0x00000000005BC000-memory.dmp

    Filesize

    48KB

  • memory/2420-6-0x00000000004C0000-0x00000000004D6000-memory.dmp

    Filesize

    88KB

  • memory/2420-0-0x000007FEF5713000-0x000007FEF5714000-memory.dmp

    Filesize

    4KB

  • memory/2420-4-0x00000000001E0000-0x00000000001E8000-memory.dmp

    Filesize

    32KB

  • memory/2420-3-0x00000000001C0000-0x00000000001DC000-memory.dmp

    Filesize

    112KB

  • memory/2420-235-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2420-2-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

    Filesize

    9.9MB

  • memory/2420-1-0x00000000012B0000-0x00000000014BC000-memory.dmp

    Filesize

    2.0MB