Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2025, 02:53

General

  • Target

    73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

  • Size

    3.6MB

  • MD5

    f2997dfb6f126670204c83344b678f0e

  • SHA1

    fb1a90117ff594cac3b2cebbbbd072674f246ce3

  • SHA256

    73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0

  • SHA512

    20bd6c2e2aebf5e96f8d9497880538061f23ed8b925cf916749da16db6339a2dd2ff5166aa0c096e23f7654e5b2959d9af108cf5ccf68291cc80f8c7c2d235ad

  • SSDEEP

    98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Detect Neshta payload 8 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
    "C:\Users\Admin\AppData\Local\Temp\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:944
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2008
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1288
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:548
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:796
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2276
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1520
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:888
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\explorer.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1772
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\smss.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2116
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1156
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2648
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\WmiPrvSE.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1588
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1720
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m7kuOebR2S.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:680
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2932
          • C:\Users\Public\Pictures\Sample Pictures\smss.exe
            "C:\Users\Public\Pictures\Sample Pictures\smss.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1948
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\explorer.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2428
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2080
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2672
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1324
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2136
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2692
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1756
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1980
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1420
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2708
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1532
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1576
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2480
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1328
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1408
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c07" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:952
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:108
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c07" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:1172

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

      Filesize

      547KB

      MD5

      cf6c595d3e5e9667667af096762fd9c4

      SHA1

      9bb44da8d7f6457099cb56e4f7d1026963dce7ce

      SHA256

      593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

      SHA512

      ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

    • C:\Users\Admin\AppData\Local\Temp\m7kuOebR2S.bat

      Filesize

      177B

      MD5

      8820377596f1f02328bfcaab5c7e7944

      SHA1

      56418e020c0aa61545d3ac4c6c9a5e9e2007eedb

      SHA256

      a2d578cc25c3dc5762a3b3de5da70474f1268f9b252df9596f43ecdab86177dc

      SHA512

      64387b8770b17ea2d1556ca3b300fd0cea5e054e2accb21363cc8e5ea84c884fba64900a71c82968f106d63821accbef69992ea53ce0774e3b6c2fdbcfe98064

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      4cb08af7460082c48a62789a4155ed02

      SHA1

      a3508deb3a79613c882f65f9fd96cef2cfad38e7

      SHA256

      297e483d85b14082d5b385483ecdf8662e8d511d5aed9a06f33b6560807997e5

      SHA512

      2dcbe031029a5c2f99ffe702da5b6320ff8f6ab312bd43ba8bcaf17fddea28528f9b7763db0b1ca4d3c400baedd01582782b0f3c8a15bb7143e2e8cfb595fdf4

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

    • \Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe

      Filesize

      3.5MB

      MD5

      3e3fe7663181211e5983da48431ddf33

      SHA1

      0bea67a96dba0798541ea15426fb0ac38c10ff06

      SHA256

      cc398c54d30b3c0c1ff1d54f03fb157578346d088c9ce38fc6347698f25fc166

      SHA512

      80056c508dade773729c239bd0b43d92c9e6d8de513b19776bf28665e37e44d022fd6c5f33ebfa3fe31b9480ce0705e9581d872b8e79703931da459d4f5922a0

    • memory/796-172-0x0000000001F50000-0x0000000001F58000-memory.dmp

      Filesize

      32KB

    • memory/796-171-0x000000001B1A0000-0x000000001B482000-memory.dmp

      Filesize

      2.9MB

    • memory/1492-267-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1492-238-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1492-242-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1492-265-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1492-266-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1492-134-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1492-269-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1948-241-0x0000000001210000-0x000000000159E000-memory.dmp

      Filesize

      3.6MB

    • memory/2320-99-0x00000000024E0000-0x00000000024F8000-memory.dmp

      Filesize

      96KB

    • memory/2320-135-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

      Filesize

      4KB

    • memory/2320-111-0x0000000002540000-0x0000000002556000-memory.dmp

      Filesize

      88KB

    • memory/2320-113-0x0000000002560000-0x0000000002572000-memory.dmp

      Filesize

      72KB

    • memory/2320-115-0x0000000002500000-0x000000000250E000-memory.dmp

      Filesize

      56KB

    • memory/2320-117-0x0000000002510000-0x0000000002520000-memory.dmp

      Filesize

      64KB

    • memory/2320-119-0x0000000002580000-0x0000000002590000-memory.dmp

      Filesize

      64KB

    • memory/2320-121-0x0000000002710000-0x000000000276A000-memory.dmp

      Filesize

      360KB

    • memory/2320-123-0x0000000002610000-0x000000000261E000-memory.dmp

      Filesize

      56KB

    • memory/2320-125-0x0000000002620000-0x0000000002630000-memory.dmp

      Filesize

      64KB

    • memory/2320-127-0x0000000002630000-0x000000000263E000-memory.dmp

      Filesize

      56KB

    • memory/2320-129-0x0000000002660000-0x0000000002678000-memory.dmp

      Filesize

      96KB

    • memory/2320-131-0x0000000002640000-0x000000000264C000-memory.dmp

      Filesize

      48KB

    • memory/2320-133-0x000000001B440000-0x000000001B48E000-memory.dmp

      Filesize

      312KB

    • memory/2320-107-0x0000000002520000-0x0000000002532000-memory.dmp

      Filesize

      72KB

    • memory/2320-109-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2320-147-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2320-105-0x0000000000C90000-0x0000000000C9E000-memory.dmp

      Filesize

      56KB

    • memory/2320-103-0x0000000000C80000-0x0000000000C90000-memory.dmp

      Filesize

      64KB

    • memory/2320-101-0x0000000000490000-0x00000000004A0000-memory.dmp

      Filesize

      64KB

    • memory/2320-174-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2320-97-0x0000000000200000-0x0000000000210000-memory.dmp

      Filesize

      64KB

    • memory/2320-201-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2320-95-0x0000000000CA0000-0x0000000000CBC000-memory.dmp

      Filesize

      112KB

    • memory/2320-93-0x00000000001F0000-0x00000000001FE000-memory.dmp

      Filesize

      56KB

    • memory/2320-91-0x0000000000C50000-0x0000000000C76000-memory.dmp

      Filesize

      152KB

    • memory/2320-17-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2320-16-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

      Filesize

      9.9MB

    • memory/2320-15-0x0000000000D50000-0x00000000010DE000-memory.dmp

      Filesize

      3.6MB

    • memory/2320-14-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

      Filesize

      4KB