Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2024, 03:03

General

  • Target

    d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe

  • Size

    2.9MB

  • MD5

    ce2ec4539435dfeac7e246fe5565c521

  • SHA1

    59f3da006005a109914c31b5d5cd94dc4c93309c

  • SHA256

    d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562

  • SHA512

    408a1db2cd98702bca3811e124d78a56cbca79a1d200593759bde1947a4a599f8cd40cd8dbb2e7be7dec416e3f5de0c4466f98ddea1daf6d313671695f25a7ba

  • SSDEEP

    49152:6h/814lignPl1s5Cp5+tOCiqgc8I7uBiYUtGGirMn0JkH4SwiLwRktMtL+CsA7Z:6h/8Hgn9u4P+l8I7uB6db0JhAw6tMtLr

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe
    "C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w3q3pbu0\w3q3pbu0.cmdline"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1690.tmp" "c:\Windows\System32\CSC1D9361651A814D138D8A3945D619A65.TMP"
        3⤵
          PID:980
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2592
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2304
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1044
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1828
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:336
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3808
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1040
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Steam\steamclient.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3352
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zmz8UYKSAt.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:3456
          • C:\Windows\system32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            3⤵
              PID:1272
            • C:\Program Files (x86)\Steam\steamclient.exe
              "C:\Program Files (x86)\Steam\steamclient.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4696
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "steamclients" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Steam\steamclient.exe'" /f
          1⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1760
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "steamclient" /sc ONLOGON /tr "'C:\Program Files (x86)\Steam\steamclient.exe'" /rl HIGHEST /f
          1⤵
          • Scheduled Task/Job: Scheduled Task
          PID:656
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "steamclients" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Steam\steamclient.exe'" /rl HIGHEST /f
          1⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4364
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562d" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'" /f
          1⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4708
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'" /rl HIGHEST /f
          1⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1272
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562d" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'" /rl HIGHEST /f
          1⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2196

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Steam\steamclient.exe

          Filesize

          2.9MB

          MD5

          ce2ec4539435dfeac7e246fe5565c521

          SHA1

          59f3da006005a109914c31b5d5cd94dc4c93309c

          SHA256

          d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562

          SHA512

          408a1db2cd98702bca3811e124d78a56cbca79a1d200593759bde1947a4a599f8cd40cd8dbb2e7be7dec416e3f5de0c4466f98ddea1daf6d313671695f25a7ba

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          cadef9abd087803c630df65264a6c81c

          SHA1

          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

          SHA256

          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

          SHA512

          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          2e907f77659a6601fcc408274894da2e

          SHA1

          9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

          SHA256

          385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

          SHA512

          34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          bd5940f08d0be56e65e5f2aaf47c538e

          SHA1

          d7e31b87866e5e383ab5499da64aba50f03e8443

          SHA256

          2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

          SHA512

          c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          59d97011e091004eaffb9816aa0b9abd

          SHA1

          1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

          SHA256

          18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

          SHA512

          d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

        • C:\Users\Admin\AppData\Local\Temp\RES1690.tmp

          Filesize

          1KB

          MD5

          5df3ff28eefacb3685ce30774f37b97e

          SHA1

          7fff18f7b12f115eeeaf51a8cc3375a298ab749f

          SHA256

          4f652cbea7e01ac1939d198c703c32e6b06af896f77a93d9fdc0e0e9d159b998

          SHA512

          6e6bb7c520efbd3f1824f2760711596554ec605d7d1cf18e1023bbb1a7b7aef35e1fc19caa44f6b989431166901b941b80b02faf33dc7957e5067ca599406b92

        • C:\Users\Admin\AppData\Local\Temp\Zmz8UYKSAt.bat

          Filesize

          220B

          MD5

          98c32a7653c79d7e7af6ac702c1128a9

          SHA1

          b4b688e29a237209a9445db092497716a12ab402

          SHA256

          897b65670ad41fe4904c0ca8bbd3379cb2a38c0378746efbe3199199d3523c3a

          SHA512

          d4c09f5900fc73808443402ebff98c8e079730436e86d2cbc32e7246b667afa95f12154bb01b6f6956aaf77eeae0b157f458173050bb7d3188d05215bc824f25

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ffqjsyd.fy3.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • \??\c:\Users\Admin\AppData\Local\Temp\w3q3pbu0\w3q3pbu0.0.cs

          Filesize

          376B

          MD5

          c2f911c4ed9b112c7a34c0c94cf74bd8

          SHA1

          663f75e21c3541217d5c0366b9fb4a01d86c5150

          SHA256

          6a2455d368282871a7f68c65a8c31c7af00e861058d72dfbb768c6000376c7cb

          SHA512

          a211d1fbb59dc00f2731e1a95a7d9819276b4c9f73d4e2641fcb9cc3ddfa8726a34e4acd4af14ed82d2f7608248c6fd6cb46acceb92c50289431869c9315b6f2

        • \??\c:\Users\Admin\AppData\Local\Temp\w3q3pbu0\w3q3pbu0.cmdline

          Filesize

          235B

          MD5

          0c0a20860332c356730d30f856840e65

          SHA1

          faf134cd679b4b49ee904ca93e126208bb8d9242

          SHA256

          8c646521c45d03dc87b1a0ceac29ea76cfb58b6fc8e4b318d7234a018b2c4bfb

          SHA512

          25b9e8cca215d55f978d2735261544fde838e635585a19084e950d12589ee2f4ff3b151e2edd908164c1b6090b3437ea4dd28c505ca4c71acd6dbcab301d717c

        • \??\c:\Windows\System32\CSC1D9361651A814D138D8A3945D619A65.TMP

          Filesize

          1KB

          MD5

          65d5babddb4bd68783c40f9e3678613f

          SHA1

          71e76abb44dbea735b9faaccb8c0fad345b514f4

          SHA256

          d61a59849cacd91b8039a8e41a5b92a7f93e2d46c90791b9ba6b5f856008cd8f

          SHA512

          21223e9a32df265bb75093d1ebaa879880a947d25ac764f3452b9104893b05f2c8fe4150cb2465681df7a0554dcefdb7f623aaf54772ade878270f453ebc1bcf

        • memory/336-3647-0x00000221C4520000-0x00000221C4542000-memory.dmp

          Filesize

          136KB

        • memory/2336-34-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-3605-0x000000001BDF0000-0x000000001BE00000-memory.dmp

          Filesize

          64KB

        • memory/2336-53-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-51-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-47-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-42-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-40-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-38-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-36-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-1-0x0000000000940000-0x0000000000948000-memory.dmp

          Filesize

          32KB

        • memory/2336-32-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-30-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-28-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-6-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-26-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-25-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-22-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-20-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-18-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-16-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-14-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-12-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-10-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-3-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-1931-0x00007FFDCF483000-0x00007FFDCF485000-memory.dmp

          Filesize

          8KB

        • memory/2336-2267-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3562-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3563-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3565-0x0000000002B90000-0x0000000002BB6000-memory.dmp

          Filesize

          152KB

        • memory/2336-3566-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3572-0x000000001BD90000-0x000000001BDE0000-memory.dmp

          Filesize

          320KB

        • memory/2336-3574-0x0000000002B50000-0x0000000002B60000-memory.dmp

          Filesize

          64KB

        • memory/2336-3579-0x0000000002B60000-0x0000000002B70000-memory.dmp

          Filesize

          64KB

        • memory/2336-3582-0x0000000002B70000-0x0000000002B80000-memory.dmp

          Filesize

          64KB

        • memory/2336-3588-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3593-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3599-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3600-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3603-0x000000001BDE0000-0x000000001BDEE000-memory.dmp

          Filesize

          56KB

        • memory/2336-49-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-3607-0x000000001BE40000-0x000000001BE50000-memory.dmp

          Filesize

          64KB

        • memory/2336-3609-0x000000001BEB0000-0x000000001BF0A000-memory.dmp

          Filesize

          360KB

        • memory/2336-3611-0x000000001BE50000-0x000000001BE5E000-memory.dmp

          Filesize

          56KB

        • memory/2336-3601-0x000000001C370000-0x000000001C898000-memory.dmp

          Filesize

          5.2MB

        • memory/2336-3598-0x000000001BE20000-0x000000001BE32000-memory.dmp

          Filesize

          72KB

        • memory/2336-3613-0x000000001BE60000-0x000000001BE70000-memory.dmp

          Filesize

          64KB

        • memory/2336-3617-0x000000001BE80000-0x000000001BE88000-memory.dmp

          Filesize

          32KB

        • memory/2336-3619-0x000000001BF10000-0x000000001BF28000-memory.dmp

          Filesize

          96KB

        • memory/2336-3621-0x000000001BE90000-0x000000001BE9C000-memory.dmp

          Filesize

          48KB

        • memory/2336-3615-0x000000001BE70000-0x000000001BE7E000-memory.dmp

          Filesize

          56KB

        • memory/2336-3596-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3595-0x000000001BE00000-0x000000001BE16000-memory.dmp

          Filesize

          88KB

        • memory/2336-3592-0x000000001B950000-0x000000001B960000-memory.dmp

          Filesize

          64KB

        • memory/2336-59-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-61-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-63-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-3670-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-65-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-57-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-68-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-55-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-46-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-44-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-8-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-4-0x000000001B4B0000-0x000000001B7E6000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-2-0x000000001B4B0000-0x000000001B7EC000-memory.dmp

          Filesize

          3.2MB

        • memory/2336-3590-0x000000001B940000-0x000000001B94C000-memory.dmp

          Filesize

          48KB

        • memory/2336-3587-0x000000001B960000-0x000000001B972000-memory.dmp

          Filesize

          72KB

        • memory/2336-3585-0x000000001B930000-0x000000001B93E000-memory.dmp

          Filesize

          56KB

        • memory/2336-3583-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3580-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3577-0x000000001B910000-0x000000001B928000-memory.dmp

          Filesize

          96KB

        • memory/2336-3575-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3571-0x00007FFDCF480000-0x00007FFDCFF41000-memory.dmp

          Filesize

          10.8MB

        • memory/2336-3570-0x000000001B8F0000-0x000000001B90C000-memory.dmp

          Filesize

          112KB

        • memory/2336-3568-0x0000000002B40000-0x0000000002B4E000-memory.dmp

          Filesize

          56KB

        • memory/2336-0-0x00007FFDCF483000-0x00007FFDCF485000-memory.dmp

          Filesize

          8KB