Analysis

  • max time kernel
    165s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 04:49

General

  • Target

    NEAS.54df88c3e72b8d4229f6bf6adabef9e0.exe

  • Size

    1.4MB

  • MD5

    54df88c3e72b8d4229f6bf6adabef9e0

  • SHA1

    c2c6ff9f9677cdeb3c88e81d97317977ca87e56e

  • SHA256

    12bcaa224d590750b33a90651d922fee72babd1d4f425ecb5f072f1679af21d5

  • SHA512

    9c347e096251b7de0562633aaf0b36cb54e83c4ad3bac70fb77ed5c215034ba96674a23f0d532c318479f839e9320a1f5b75aa387371873edca3a3fecc22034d

  • SSDEEP

    24576:qBBkOlRe8ZcXPuCyRdaN1yV/vELneAcCg8:uOOy8eEa1Jct8

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 9 IoCs
  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.54df88c3e72b8d4229f6bf6adabef9e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.54df88c3e72b8d4229f6bf6adabef9e0.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4832
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:8
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5076
    • C:\Recovery\WindowsRE\csrss.exe
      "C:\Recovery\WindowsRE\csrss.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5736
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d8bcf71-f23d-4479-9ac7-b92664fc1657.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5156
        • C:\Recovery\WindowsRE\csrss.exe
          C:\Recovery\WindowsRE\csrss.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5664
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\279a4862-757c-452d-aa5b-3eb7074d611a.vbs"
            5⤵
              PID:3532
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83239a2d-94d9-466e-8e24-929a88e27bba.vbs"
              5⤵
                PID:5584
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c81cdece-bd16-43c6-8ba7-2acc0a76a7c6.vbs"
            3⤵
              PID:5220
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4444
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4092
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1108
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\SppExtComObj.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4204
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4136
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4788

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Recovery\WindowsRE\csrss.exe

                Filesize

                1.4MB

                MD5

                54df88c3e72b8d4229f6bf6adabef9e0

                SHA1

                c2c6ff9f9677cdeb3c88e81d97317977ca87e56e

                SHA256

                12bcaa224d590750b33a90651d922fee72babd1d4f425ecb5f072f1679af21d5

                SHA512

                9c347e096251b7de0562633aaf0b36cb54e83c4ad3bac70fb77ed5c215034ba96674a23f0d532c318479f839e9320a1f5b75aa387371873edca3a3fecc22034d

              • C:\Recovery\WindowsRE\csrss.exe

                Filesize

                1.4MB

                MD5

                54df88c3e72b8d4229f6bf6adabef9e0

                SHA1

                c2c6ff9f9677cdeb3c88e81d97317977ca87e56e

                SHA256

                12bcaa224d590750b33a90651d922fee72babd1d4f425ecb5f072f1679af21d5

                SHA512

                9c347e096251b7de0562633aaf0b36cb54e83c4ad3bac70fb77ed5c215034ba96674a23f0d532c318479f839e9320a1f5b75aa387371873edca3a3fecc22034d

              • C:\Recovery\WindowsRE\csrss.exe

                Filesize

                1.4MB

                MD5

                54df88c3e72b8d4229f6bf6adabef9e0

                SHA1

                c2c6ff9f9677cdeb3c88e81d97317977ca87e56e

                SHA256

                12bcaa224d590750b33a90651d922fee72babd1d4f425ecb5f072f1679af21d5

                SHA512

                9c347e096251b7de0562633aaf0b36cb54e83c4ad3bac70fb77ed5c215034ba96674a23f0d532c318479f839e9320a1f5b75aa387371873edca3a3fecc22034d

              • C:\Recovery\WindowsRE\csrss.exe

                Filesize

                1.4MB

                MD5

                54df88c3e72b8d4229f6bf6adabef9e0

                SHA1

                c2c6ff9f9677cdeb3c88e81d97317977ca87e56e

                SHA256

                12bcaa224d590750b33a90651d922fee72babd1d4f425ecb5f072f1679af21d5

                SHA512

                9c347e096251b7de0562633aaf0b36cb54e83c4ad3bac70fb77ed5c215034ba96674a23f0d532c318479f839e9320a1f5b75aa387371873edca3a3fecc22034d

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

                Filesize

                1KB

                MD5

                9b0256da3bf9a5303141361b3da59823

                SHA1

                d73f34951777136c444eb2c98394f62912ebcdac

                SHA256

                96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e

                SHA512

                9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                e243a38635ff9a06c87c2a61a2200656

                SHA1

                ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                SHA256

                af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                SHA512

                4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                e243a38635ff9a06c87c2a61a2200656

                SHA1

                ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                SHA256

                af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                SHA512

                4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                d28a889fd956d5cb3accfbaf1143eb6f

                SHA1

                157ba54b365341f8ff06707d996b3635da8446f7

                SHA256

                21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                SHA512

                0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                aaaac7c68d2b7997ed502c26fd9f65c2

                SHA1

                7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                SHA256

                8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                SHA512

                c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                aaaac7c68d2b7997ed502c26fd9f65c2

                SHA1

                7c5a3731300d672bf53c43e2f9e951c745f7fbdf

                SHA256

                8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

                SHA512

                c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                a8e8360d573a4ff072dcc6f09d992c88

                SHA1

                3446774433ceaf0b400073914facab11b98b6807

                SHA256

                bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

                SHA512

                4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                e448fe0d240184c6597a31d3be2ced58

                SHA1

                372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                SHA256

                c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                SHA512

                0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                e448fe0d240184c6597a31d3be2ced58

                SHA1

                372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                SHA256

                c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                SHA512

                0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                cadef9abd087803c630df65264a6c81c

                SHA1

                babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                SHA256

                cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                SHA512

                7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                cadef9abd087803c630df65264a6c81c

                SHA1

                babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                SHA256

                cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                SHA512

                7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                cadef9abd087803c630df65264a6c81c

                SHA1

                babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                SHA256

                cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                SHA512

                7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

              • C:\Users\Admin\AppData\Local\Temp\279a4862-757c-452d-aa5b-3eb7074d611a.vbs

                Filesize

                707B

                MD5

                05a28590680a059656a923a6b608b6a0

                SHA1

                77c73b5cba163ead23bafbfaa38601a129ece182

                SHA256

                6771f70265e565bb47630ae4561bda15faf30f662a7551c8d6cc9bfd073944a2

                SHA512

                545d27a02b5501581f98742f52942f27f3113ac2ec6a87c65d8282afbbfd294d26de5568abec6759bbd1026e66207bcad6a0895961d7f3b1bfb5afe5c1bb1804

              • C:\Users\Admin\AppData\Local\Temp\7d8bcf71-f23d-4479-9ac7-b92664fc1657.vbs

                Filesize

                707B

                MD5

                70b2a9f0a3dd55222e729bd70dbe5f6b

                SHA1

                7a979224dc14327c74cf7b4237b305e30bc2ddb8

                SHA256

                bc089e7e8dfdb88e340593412af9af3dad468c580169e677fd9877993892d251

                SHA512

                85a770e95cd03def2bb20aaa2abe0982db1cb746aa279eaec7c57acd13bcb67df44f889a6252238985e6a1809bdcc950a3c18f147b5ce9253a1d63e22f50a223

              • C:\Users\Admin\AppData\Local\Temp\83239a2d-94d9-466e-8e24-929a88e27bba.vbs

                Filesize

                483B

                MD5

                1ebf7be841955424f63b671d01ee5ebe

                SHA1

                abe2236e60c57264fe2e90f2c14cc33b9bfc41a7

                SHA256

                bcf72b16678b1c05d772504f9558b546edb2938b433e6cf7068c3947e7758980

                SHA512

                99f433060575e67b452957a2e170be7c900cda8e827adb735ebdaf16163120e55622c84100ec19869b1344fab3270530c9e1eb032510598898974c75f52a4d76

              • C:\Users\Admin\AppData\Local\Temp\83239a2d-94d9-466e-8e24-929a88e27bba.vbs

                Filesize

                483B

                MD5

                1ebf7be841955424f63b671d01ee5ebe

                SHA1

                abe2236e60c57264fe2e90f2c14cc33b9bfc41a7

                SHA256

                bcf72b16678b1c05d772504f9558b546edb2938b433e6cf7068c3947e7758980

                SHA512

                99f433060575e67b452957a2e170be7c900cda8e827adb735ebdaf16163120e55622c84100ec19869b1344fab3270530c9e1eb032510598898974c75f52a4d76

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xnho3g5y.rjo.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\c81cdece-bd16-43c6-8ba7-2acc0a76a7c6.vbs

                Filesize

                483B

                MD5

                1ebf7be841955424f63b671d01ee5ebe

                SHA1

                abe2236e60c57264fe2e90f2c14cc33b9bfc41a7

                SHA256

                bcf72b16678b1c05d772504f9558b546edb2938b433e6cf7068c3947e7758980

                SHA512

                99f433060575e67b452957a2e170be7c900cda8e827adb735ebdaf16163120e55622c84100ec19869b1344fab3270530c9e1eb032510598898974c75f52a4d76

              • C:\Users\Admin\AppData\Local\Temp\c88b212018e3d354cfac96b9cde4cd80ce2bf2dc.exe

                Filesize

                1.4MB

                MD5

                54df88c3e72b8d4229f6bf6adabef9e0

                SHA1

                c2c6ff9f9677cdeb3c88e81d97317977ca87e56e

                SHA256

                12bcaa224d590750b33a90651d922fee72babd1d4f425ecb5f072f1679af21d5

                SHA512

                9c347e096251b7de0562633aaf0b36cb54e83c4ad3bac70fb77ed5c215034ba96674a23f0d532c318479f839e9320a1f5b75aa387371873edca3a3fecc22034d

              • memory/8-246-0x0000023746470000-0x0000023746480000-memory.dmp

                Filesize

                64KB

              • memory/8-244-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/488-243-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/488-247-0x0000020FA7310000-0x0000020FA7320000-memory.dmp

                Filesize

                64KB

              • memory/488-245-0x0000020FA7310000-0x0000020FA7320000-memory.dmp

                Filesize

                64KB

              • memory/1372-83-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/1744-262-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/1744-263-0x000001FA84670000-0x000001FA84680000-memory.dmp

                Filesize

                64KB

              • memory/3108-80-0x0000021189F70000-0x0000021189F80000-memory.dmp

                Filesize

                64KB

              • memory/3108-78-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/3512-249-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/3512-76-0x000001E954FD0000-0x000001E954FE0000-memory.dmp

                Filesize

                64KB

              • memory/3596-22-0x000000001BC90000-0x000000001BC9E000-memory.dmp

                Filesize

                56KB

              • memory/3596-24-0x000000001BCB0000-0x000000001BCB8000-memory.dmp

                Filesize

                32KB

              • memory/3596-72-0x000000001C2A0000-0x000000001C3A0000-memory.dmp

                Filesize

                1024KB

              • memory/3596-1-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/3596-2-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-3-0x00000000028D0000-0x00000000028DE000-memory.dmp

                Filesize

                56KB

              • memory/3596-4-0x00000000028E0000-0x00000000028E8000-memory.dmp

                Filesize

                32KB

              • memory/3596-60-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-42-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-41-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-5-0x00000000028F0000-0x000000000290C000-memory.dmp

                Filesize

                112KB

              • memory/3596-6-0x000000001B4A0000-0x000000001B4F0000-memory.dmp

                Filesize

                320KB

              • memory/3596-36-0x000000001C2A0000-0x000000001C3A0000-memory.dmp

                Filesize

                1024KB

              • memory/3596-35-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-7-0x0000000002920000-0x0000000002928000-memory.dmp

                Filesize

                32KB

              • memory/3596-8-0x0000000002930000-0x0000000002940000-memory.dmp

                Filesize

                64KB

              • memory/3596-9-0x0000000002940000-0x0000000002956000-memory.dmp

                Filesize

                88KB

              • memory/3596-10-0x0000000002960000-0x0000000002970000-memory.dmp

                Filesize

                64KB

              • memory/3596-34-0x000000001C2A0000-0x000000001C3A0000-memory.dmp

                Filesize

                1024KB

              • memory/3596-33-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/3596-30-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-29-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-26-0x000000001BCD0000-0x000000001BCDC000-memory.dmp

                Filesize

                48KB

              • memory/3596-11-0x0000000002970000-0x000000000297A000-memory.dmp

                Filesize

                40KB

              • memory/3596-25-0x000000001BCC0000-0x000000001BCCA000-memory.dmp

                Filesize

                40KB

              • memory/3596-12-0x0000000002980000-0x000000000298C000-memory.dmp

                Filesize

                48KB

              • memory/3596-70-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-23-0x000000001BCA0000-0x000000001BCAC000-memory.dmp

                Filesize

                48KB

              • memory/3596-0-0x00000000006A0000-0x000000000080C000-memory.dmp

                Filesize

                1.4MB

              • memory/3596-21-0x000000001BC80000-0x000000001BC88000-memory.dmp

                Filesize

                32KB

              • memory/3596-264-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/3596-13-0x00000000029A0000-0x00000000029AC000-memory.dmp

                Filesize

                48KB

              • memory/3596-20-0x000000001BC70000-0x000000001BC7E000-memory.dmp

                Filesize

                56KB

              • memory/3596-19-0x000000001BC60000-0x000000001BC6A000-memory.dmp

                Filesize

                40KB

              • memory/3596-17-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-18-0x0000000002990000-0x00000000029A0000-memory.dmp

                Filesize

                64KB

              • memory/3596-16-0x000000001B500000-0x000000001B508000-memory.dmp

                Filesize

                32KB

              • memory/3596-15-0x000000001B4F0000-0x000000001B4FC000-memory.dmp

                Filesize

                48KB

              • memory/3596-14-0x00000000029B0000-0x00000000029B8000-memory.dmp

                Filesize

                32KB

              • memory/3976-94-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/3976-174-0x000001B040950000-0x000001B040960000-memory.dmp

                Filesize

                64KB

              • memory/3976-147-0x000001B040950000-0x000001B040960000-memory.dmp

                Filesize

                64KB

              • memory/4756-109-0x0000029D7F320000-0x0000029D7F342000-memory.dmp

                Filesize

                136KB

              • memory/4756-82-0x0000029D7F550000-0x0000029D7F560000-memory.dmp

                Filesize

                64KB

              • memory/4756-81-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/4832-250-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/4832-77-0x0000012FEC510000-0x0000012FEC520000-memory.dmp

                Filesize

                64KB

              • memory/4880-75-0x0000024649130000-0x0000024649140000-memory.dmp

                Filesize

                64KB

              • memory/4880-74-0x0000024649130000-0x0000024649140000-memory.dmp

                Filesize

                64KB

              • memory/4880-73-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB

              • memory/5076-248-0x000002ADA12B0000-0x000002ADA12C0000-memory.dmp

                Filesize

                64KB

              • memory/5076-265-0x00007FF9B0660000-0x00007FF9B1121000-memory.dmp

                Filesize

                10.8MB