Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/11/2022, 11:43

General

  • Target

    b37c1251dd690732dc9d6bb71148890e0f0d1fc442d32662d2dac4e14daf3c24.exe

  • Size

    1.3MB

  • MD5

    7019c18aa25bdcc747be930118855e1f

  • SHA1

    c639dceec11f5ffff5b45f8e5ecef93dc73dc01e

  • SHA256

    b37c1251dd690732dc9d6bb71148890e0f0d1fc442d32662d2dac4e14daf3c24

  • SHA512

    70aa7ecee4f6b5fd3688b8643b704d93989aedda519caae15d6352cd3abd69dc557e1b264a5e2e6148ef73edd70b6a87c0e72465aaee43b39a65e6597bfcfac2

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 17 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b37c1251dd690732dc9d6bb71148890e0f0d1fc442d32662d2dac4e14daf3c24.exe
    "C:\Users\Admin\AppData\Local\Temp\b37c1251dd690732dc9d6bb71148890e0f0d1fc442d32662d2dac4e14daf3c24.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4272
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4968
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Links\fontdrvhost.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\cmd.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4848
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Pictures\SearchUI.exe'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3328
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RDNeSBVcnB.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:188
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:728
              • C:\Users\Admin\Links\fontdrvhost.exe
                "C:\Users\Admin\Links\fontdrvhost.exe"
                6⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1456
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fq9TqI16of.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3564
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:3476
                    • C:\Users\Admin\Links\fontdrvhost.exe
                      "C:\Users\Admin\Links\fontdrvhost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4832
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4768
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:4136
                          • C:\Users\Admin\Links\fontdrvhost.exe
                            "C:\Users\Admin\Links\fontdrvhost.exe"
                            10⤵
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3168
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NHYDEKme3A.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3264
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:692
                                • C:\Users\Admin\Links\fontdrvhost.exe
                                  "C:\Users\Admin\Links\fontdrvhost.exe"
                                  12⤵
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:3788
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4984
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:2232
                                      • C:\Users\Admin\Links\fontdrvhost.exe
                                        "C:\Users\Admin\Links\fontdrvhost.exe"
                                        14⤵
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:732
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OMiKQlKjHz.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1900
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:4596
                                            • C:\Users\Admin\Links\fontdrvhost.exe
                                              "C:\Users\Admin\Links\fontdrvhost.exe"
                                              16⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:504
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:2428
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:4032
                                                  • C:\Users\Admin\Links\fontdrvhost.exe
                                                    "C:\Users\Admin\Links\fontdrvhost.exe"
                                                    18⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3160
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"
                                                      19⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4792
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        20⤵
                                                          PID:4632
                                                        • C:\Users\Admin\Links\fontdrvhost.exe
                                                          "C:\Users\Admin\Links\fontdrvhost.exe"
                                                          20⤵
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3552
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mxrgiezM67.bat"
                                                            21⤵
                                                              PID:4904
                                                              • C:\Users\Admin\Links\fontdrvhost.exe
                                                                "C:\Users\Admin\Links\fontdrvhost.exe"
                                                                22⤵
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1676
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j2qd1ZwTnL.bat"
                                                                  23⤵
                                                                    PID:4384
                                                                    • C:\Users\Admin\Links\fontdrvhost.exe
                                                                      "C:\Users\Admin\Links\fontdrvhost.exe"
                                                                      24⤵
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1500
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"
                                                                        25⤵
                                                                          PID:3192
                                                                          • C:\Windows\system32\w32tm.exe
                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                            26⤵
                                                                              PID:2776
                                                                            • C:\Users\Admin\Links\fontdrvhost.exe
                                                                              "C:\Users\Admin\Links\fontdrvhost.exe"
                                                                              26⤵
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2816
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\guIa2jZB2U.bat"
                                                                                27⤵
                                                                                  PID:1124
                                                                                  • C:\Users\Admin\Links\fontdrvhost.exe
                                                                                    "C:\Users\Admin\Links\fontdrvhost.exe"
                                                                                    28⤵
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4028
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat"
                                                                                      29⤵
                                                                                        PID:4216
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          30⤵
                                                                                            PID:4300
                                                                                          • C:\Users\Admin\Links\fontdrvhost.exe
                                                                                            "C:\Users\Admin\Links\fontdrvhost.exe"
                                                                                            30⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:1388
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Links\fontdrvhost.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:3900
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Links\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4960
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Links\fontdrvhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4344
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\security\cmd.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4764
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\security\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:2800
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\security\cmd.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4484
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Documents\My Pictures\SearchUI.exe'" /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4596
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Pictures\SearchUI.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4716
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "SearchUIS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\My Pictures\SearchUI.exe'" /rl HIGHEST /f
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Creates scheduled task(s)
                                  PID:4984
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  1⤵
                                    PID:680
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    1⤵
                                      PID:4820
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      1⤵
                                        PID:4192

                                      Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              d63ff49d7c92016feb39812e4db10419

                                              SHA1

                                              2307d5e35ca9864ffefc93acf8573ea995ba189b

                                              SHA256

                                              375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

                                              SHA512

                                              00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                              Filesize

                                              3KB

                                              MD5

                                              8592ba100a78835a6b94d5949e13dfc1

                                              SHA1

                                              63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                              SHA256

                                              fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                              SHA512

                                              87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              1KB

                                              MD5

                                              6bae30481db65844ad0782d31b40f9ca

                                              SHA1

                                              21830d8da6cc62d82840f29e8bd3421c1945b128

                                              SHA256

                                              dbbb01236f3e58071375220d1c81b9e57e43bda57597633a5e4fd7428153d21c

                                              SHA512

                                              2e40d3d57a78b64b779420de7426b16dd8a45de8bb29ba22f1a139901d9f3a2d4f7bbe0dd1790332eb7883a8986ba12c2fc66122e8f580631bbcb72630b1788a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              1KB

                                              MD5

                                              6bae30481db65844ad0782d31b40f9ca

                                              SHA1

                                              21830d8da6cc62d82840f29e8bd3421c1945b128

                                              SHA256

                                              dbbb01236f3e58071375220d1c81b9e57e43bda57597633a5e4fd7428153d21c

                                              SHA512

                                              2e40d3d57a78b64b779420de7426b16dd8a45de8bb29ba22f1a139901d9f3a2d4f7bbe0dd1790332eb7883a8986ba12c2fc66122e8f580631bbcb72630b1788a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              1KB

                                              MD5

                                              c492bc991bfad9c03febe497847113ac

                                              SHA1

                                              1de2ad71e1f0cbfdcf9b231c27ec003f2fd7c74d

                                              SHA256

                                              17f749f04c4f4e5f7b815f23ec0bca5a40d29a7420b5200bfc3a5ec704dc1c32

                                              SHA512

                                              bb648145d3f60091b6e08181b7f9d52682fd7519db13c4e46aeceba61ff366fae73d7dd8b082ec12d155142a23109128db995ecbbabbf225fdf7baa8e5e0a626

                                            • C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat

                                              Filesize

                                              201B

                                              MD5

                                              6566c208f5ea3951164af4df99c9bdc4

                                              SHA1

                                              08c2371707751840378fa276cc6895447af72f97

                                              SHA256

                                              ec89d6ad214a8662ef7d79ef3ec730310cf7de331690c9f9f9448c34a9f8b20d

                                              SHA512

                                              d2f9a4240215d3ab6b27aa49145d2cdb9a165f284a6c13d9c769eaed908e1066f3904e155f7321eb66fbda4a17d7a2e7d9376e276620c0c1d84608a49124d6a1

                                            • C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat

                                              Filesize

                                              201B

                                              MD5

                                              d9343deb8843d38e3fa399c0fb7f3eee

                                              SHA1

                                              a698e9c89e8c9b9c326fe8cca42c20e109f8c6e8

                                              SHA256

                                              75417f34a760bf5a076f07e05c9d4a6f73e2a53f8d393990c893756c02d29e69

                                              SHA512

                                              ee6e14410cc59d1ff65d1518667a08af636f7b0934ed48cb6bf0bed72e73e2458ba29a10b3aee99bd36b6b4b3eb2be30508133d02b4477de609a9b10a3c0e043

                                            • C:\Users\Admin\AppData\Local\Temp\NHYDEKme3A.bat

                                              Filesize

                                              201B

                                              MD5

                                              850c31b89766643e5101022f14592a26

                                              SHA1

                                              f85d6b11bfea758234662f3ebbabd5eb2f33f503

                                              SHA256

                                              bfd4af0f79749dfa4e3a0ccf60c583ff7146c768e8a8df823587bd2d6a9b07ca

                                              SHA512

                                              d5055174072fbcdeb5fffaf084eab7c7385b301e17674156793fa9e6c7145805d2568c98d5bd745771e5a2faab74f68389d40abc377c4b49a047e92fd479b274

                                            • C:\Users\Admin\AppData\Local\Temp\OMiKQlKjHz.bat

                                              Filesize

                                              201B

                                              MD5

                                              5c1bfbf4f796153f9ef00da271e4fda0

                                              SHA1

                                              80b8c9eff09d2b1fb5ce7d5e9d012916e859f768

                                              SHA256

                                              123f5296b7289237929041af9851c550be9088b73231d0916bceed28fdfd0e7b

                                              SHA512

                                              c1d24bb1dbceab382cfcf1ece14b569038e4d313bbb8533024c75475ed47ad529555d3fc1e7d1528882d0424b9c5254118478236a3130dcb769e96491eb737f2

                                            • C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

                                              Filesize

                                              201B

                                              MD5

                                              f5b29a71d5401dc956e1173ac46fbbd6

                                              SHA1

                                              ae4c4f5e4b1e2d259f3f8adf007a885bfce8abdc

                                              SHA256

                                              759f18633ec7f561b4a5ec662656602ceace4f4fa0482bfe93ff94e37ee3c530

                                              SHA512

                                              f0ebfc38a5bfc5216d60bb10cd1714a972594760d9edd5ad53856a0be81968dea88c1880ca49fa1c2de54c33ffa108fe48f870fcbd7869d9ab94480d8a36ce3c

                                            • C:\Users\Admin\AppData\Local\Temp\RDNeSBVcnB.bat

                                              Filesize

                                              201B

                                              MD5

                                              7f7d15ded93c2719e69f5192c859f239

                                              SHA1

                                              03af27ef38d587d4f3bdad9fecb028852dac10e8

                                              SHA256

                                              fc8e47b6c996a23da8ba391b070a2165401f38dafc200d58b6de4acf78ffaf39

                                              SHA512

                                              7d19e4a868fb19fa0920c62cf29d48dea08769c406d810ff90925bcc1f0330ea23b02dac9bdd6209d7fa2289016993b641ada9b76bd7ab6d41426cd24edb2c7d

                                            • C:\Users\Admin\AppData\Local\Temp\XBBOHPKclM.bat

                                              Filesize

                                              201B

                                              MD5

                                              017c77fd2c587bbc3f01a312b1bb26bb

                                              SHA1

                                              8e9dae318cb7edc97deeb962184059b6eb129572

                                              SHA256

                                              d0e499515d44eb6eb923bc35b5001312d82c77bd7f8037fdd5786787312ff94c

                                              SHA512

                                              77231b551762dfb95b3cace7ba7f852f258b13f79a777711c71887e2b35c2d9cef91ab96753f2c37f18c78eb6486162697e2c02debdb79e6087793bb588f9313

                                            • C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat

                                              Filesize

                                              201B

                                              MD5

                                              06441b9a4ec0adf9e87833216d699167

                                              SHA1

                                              273a3bd77d1faa658b844865ee6b76014517be68

                                              SHA256

                                              b3440a3c7d02b9fcf4cbc6c9387eb9de25e3c690229e63a721332f197f7fbb99

                                              SHA512

                                              30f89deedcb72f6703e4708e99c22f2a83bc51c0520469e925d5d1274537609e12f2ff23e848c15c64c53a290ec1fa11d5b1e0b6489c873cef0eb890ba0ab2bc

                                            • C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat

                                              Filesize

                                              201B

                                              MD5

                                              06441b9a4ec0adf9e87833216d699167

                                              SHA1

                                              273a3bd77d1faa658b844865ee6b76014517be68

                                              SHA256

                                              b3440a3c7d02b9fcf4cbc6c9387eb9de25e3c690229e63a721332f197f7fbb99

                                              SHA512

                                              30f89deedcb72f6703e4708e99c22f2a83bc51c0520469e925d5d1274537609e12f2ff23e848c15c64c53a290ec1fa11d5b1e0b6489c873cef0eb890ba0ab2bc

                                            • C:\Users\Admin\AppData\Local\Temp\fq9TqI16of.bat

                                              Filesize

                                              201B

                                              MD5

                                              6028b1ace15c62873c978ac23ddf3748

                                              SHA1

                                              394203161adde48a23f19db16341bedbd38ffd9d

                                              SHA256

                                              4ac46e3ac3ded33ca9b3a83eed80d260c5c45bc831d4934f0ee70f338c128f9d

                                              SHA512

                                              2a6ba12e8fcf64e110b9202af56164d1f0f043ef86db11ffdac935d8e8da02a5c4f7de0d89e595c2136c7ffb791e143fd5bb0ff9e31332984736e2092ca606b4

                                            • C:\Users\Admin\AppData\Local\Temp\guIa2jZB2U.bat

                                              Filesize

                                              201B

                                              MD5

                                              a6108e45f850e336391dba35a7e8dd9d

                                              SHA1

                                              8674c2463bf0ac4263d3b2d03dbee201bbc204d4

                                              SHA256

                                              accfe021ac0d383639ea4979f4914ca36e9cd2ac8f7ce99ca4c3d1884c137b1b

                                              SHA512

                                              cb927ce895b3cdbac9a9459809aa3ae8fa800141871c6d68df2ea0defba51e7fabc7cf680ecfaee3a96450925753c4bf9dd359633f5f2482f2a6d0ac1e0e9746

                                            • C:\Users\Admin\AppData\Local\Temp\j2qd1ZwTnL.bat

                                              Filesize

                                              201B

                                              MD5

                                              2718a5c8a37ce1a45f000554cb5eed1e

                                              SHA1

                                              708cf02945f7dd97582d3c1a94531e25febaa86d

                                              SHA256

                                              2084e37c6d5ed3bfee2a9f05bdc9c2a219c6f0c12ac242b5a6be79162cdd7c3c

                                              SHA512

                                              2c2bd480e44801aff51bf4c857a001f6b657b229c5f2d1c9743bdaeb88fef4875d122d735b3ccdfb3ec1d4b272db67a00e494bcd9c7be724165fc443755ad3a0

                                            • C:\Users\Admin\AppData\Local\Temp\mxrgiezM67.bat

                                              Filesize

                                              201B

                                              MD5

                                              dd6f35f287ebb578f9f1ac83cee41691

                                              SHA1

                                              13e0d2489bb0bd0d5422fdd38a0811e36087078b

                                              SHA256

                                              31dddc072c9ae262e6f3061164f3254103e7281720ba05b8a449b01224b11cd4

                                              SHA512

                                              1deef14a420c415e3746ac2b4ec3d3ab47c31f93891daaca76f0293b20b18fb5596239511090eb0d5c80e8c69f6174f48be5b124fba507c2d053c2c0e5db3b47

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\Users\Admin\Links\fontdrvhost.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/732-460-0x0000000000E70000-0x0000000000E82000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/1388-501-0x0000000001040000-0x0000000001052000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2248-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/2248-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/3200-287-0x000000001BA40000-0x000000001BA4C000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3200-288-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3200-284-0x00000000004A0000-0x00000000005B0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/3200-286-0x0000000000EC0000-0x0000000000ECC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3200-285-0x0000000000EB0000-0x0000000000EC2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/3788-454-0x00000000029E0000-0x00000000029F2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4288-318-0x0000025AB2C30000-0x0000025AB2CA6000-memory.dmp

                                              Filesize

                                              472KB

                                            • memory/4512-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/4512-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

                                              Filesize

                                              1.6MB

                                            • memory/4832-443-0x00000000015D0000-0x00000000015E2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4968-309-0x000001D762110000-0x000001D762132000-memory.dmp

                                              Filesize

                                              136KB