Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 02:45

General

  • Target

    cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe

  • Size

    2.8MB

  • MD5

    2397e7230770a20dd685f8903b0e7759

  • SHA1

    bc280c16c4f89338df7c3745d0821432443d565c

  • SHA256

    cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67

  • SHA512

    97923122007bae611db6deb97e25a83f3636bec7c4d4d60aea2638edbeeaf85cef4c7c8755a442fd6525940154ec0d92258a65acdc065d75e1729b602510d7aa

  • SSDEEP

    49152:Or8U+ST8nT/r5mZxSuCspYhU7F6511YoWN/qiUt9ETxJ5WGAf2VR:vSi/rwZYuCspQUA5vNWNqGfAGAA

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 42 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • DCRat payload 7 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe
    "C:\Users\Admin\AppData\Local\Temp\cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2520
    • C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe
      "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:872
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2908
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2748
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3016
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67c" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\en-US\cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2420
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2752
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67c" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1728
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\ja-JP\services.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2640
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\services.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2596
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\ja-JP\services.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2624
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Templates\System.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2308
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Templates\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:588
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Templates\System.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:992
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\lsm.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:568
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\lsm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1612
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\lsm.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1220
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\audiodg.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2148
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\audiodg.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2504
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\audiodg.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1880
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\taskhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1692
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Google\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:800
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1636
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sppsvc.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1588
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1780
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1672
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\spoolsv.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2788
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2996
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2160
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2792
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2416
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1128
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:408
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2968
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2036
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1532
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2316
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\csrss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1472
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1272
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1308
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\sppsvc.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:912
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Pictures\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1680
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\sppsvc.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2488

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\audiodg.exe

          Filesize

          2.8MB

          MD5

          0d7069a748e26776c124602ea98c2d64

          SHA1

          422eedfee5e7918363947aa9a219d78859d36685

          SHA256

          71a4cd77b80a4cb67a67ac8a5431b9a1cac939f5be9c41362ed44607df43bd1f

          SHA512

          3c8c9d328616e0c3e0576d175d3a44ff1b4e2a44bc0708deda232b3291c24bb1add0ce685a8652bcce2050c7993ecd7aa8d1b018cf9f5c0fbb08fccc863ed0f0

        • C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\lsm.exe

          Filesize

          2.8MB

          MD5

          2397e7230770a20dd685f8903b0e7759

          SHA1

          bc280c16c4f89338df7c3745d0821432443d565c

          SHA256

          cf2af3301f31bae02df162a5287f7671b353a4d7c704235e84661778a92c0b67

          SHA512

          97923122007bae611db6deb97e25a83f3636bec7c4d4d60aea2638edbeeaf85cef4c7c8755a442fd6525940154ec0d92258a65acdc065d75e1729b602510d7aa

        • C:\Users\Default\csrss.exe

          Filesize

          2.8MB

          MD5

          1a4d5652bfbc907dde444f5755637a72

          SHA1

          535a7dc6e5f5c06e9f7f623f11132755ca05a925

          SHA256

          99b23402f8bd95601e1bdde5683c5e904115258a6bad84cd96bac54aa62a0668

          SHA512

          aec6a064d4882b9eb34a0532a124ba50fea16af752bf6e16af40eff3bd3125a488fe23d18396a057d13867a53437ae56bb8ee6e8784540b99ef33ede87e9a2ba

        • C:\Users\Default\sppsvc.exe

          Filesize

          2.8MB

          MD5

          be45c9bfb41a60772e95105e3f00cfde

          SHA1

          2a65e4febe0863070c56e69c0ce75d8806c15a60

          SHA256

          98f667db4918fd77c14520609436555b19c14afcd28e61abcd15257a8d310ac4

          SHA512

          bccf38abac0135152d02d051a95996cf9a74f4370802f315817c724e6f9cd81a89cf3775a86fa3dfe215b024f35897d7697ff77fe0490b01f07facfeb8516b25

        • C:\Users\Public\Pictures\RCXE28F.tmp

          Filesize

          2.8MB

          MD5

          f66e86fa8dc954088f3e2a8836c65b07

          SHA1

          415a7e186a5d52238d18b3920be728137f295982

          SHA256

          f7094d6aa726adfaf925828ce8f4440d86d9bf5356fdc1ded11048d3bb2b7aa4

          SHA512

          d47b02814d0220f2282ffa986b35659b216299a899fafd1ce52d8b589b3e392e3c0d5508b7ca4ce4bfb897736f4b8559398410dc683c767af9b86fb1ab5caced

        • memory/872-230-0x0000000000B90000-0x0000000000BA2000-memory.dmp

          Filesize

          72KB

        • memory/872-229-0x0000000000DB0000-0x000000000107A000-memory.dmp

          Filesize

          2.8MB

        • memory/2520-7-0x0000000000A40000-0x0000000000A56000-memory.dmp

          Filesize

          88KB

        • memory/2520-20-0x000000001AD90000-0x000000001AD9C000-memory.dmp

          Filesize

          48KB

        • memory/2520-9-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

          Filesize

          40KB

        • memory/2520-10-0x0000000000B00000-0x0000000000B56000-memory.dmp

          Filesize

          344KB

        • memory/2520-11-0x0000000000B50000-0x0000000000B58000-memory.dmp

          Filesize

          32KB

        • memory/2520-12-0x0000000000B60000-0x0000000000B72000-memory.dmp

          Filesize

          72KB

        • memory/2520-13-0x0000000000F20000-0x0000000000F28000-memory.dmp

          Filesize

          32KB

        • memory/2520-14-0x0000000000F30000-0x0000000000F3C000-memory.dmp

          Filesize

          48KB

        • memory/2520-15-0x0000000000F40000-0x0000000000F48000-memory.dmp

          Filesize

          32KB

        • memory/2520-16-0x0000000000F50000-0x0000000000F5C000-memory.dmp

          Filesize

          48KB

        • memory/2520-17-0x000000001AD60000-0x000000001AD6E000-memory.dmp

          Filesize

          56KB

        • memory/2520-19-0x000000001AD80000-0x000000001AD8C000-memory.dmp

          Filesize

          48KB

        • memory/2520-18-0x000000001AD70000-0x000000001AD7E000-memory.dmp

          Filesize

          56KB

        • memory/2520-0-0x000007FEF59D3000-0x000007FEF59D4000-memory.dmp

          Filesize

          4KB

        • memory/2520-21-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2520-8-0x0000000000A60000-0x0000000000A68000-memory.dmp

          Filesize

          32KB

        • memory/2520-6-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

        • memory/2520-5-0x00000000003E0000-0x00000000003E8000-memory.dmp

          Filesize

          32KB

        • memory/2520-147-0x000007FEF59D3000-0x000007FEF59D4000-memory.dmp

          Filesize

          4KB

        • memory/2520-172-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2520-197-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2520-4-0x0000000000A20000-0x0000000000A3C000-memory.dmp

          Filesize

          112KB

        • memory/2520-3-0x00000000003D0000-0x00000000003DE000-memory.dmp

          Filesize

          56KB

        • memory/2520-2-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2520-228-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2520-1-0x0000000000F60000-0x000000000122A000-memory.dmp

          Filesize

          2.8MB