Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 11:24

General

  • Target

    DCrat.exe

  • Size

    3.7MB

  • MD5

    22cc90f49c151e2b37d98947d4fc7390

  • SHA1

    2838b3e4d3d67bd9af50535130c017f3f0e03e61

  • SHA256

    1177a24b2539e173f4f9d25c0f3e43a22d23ec64b562a86b4b7ef65741734067

  • SHA512

    12eae0f34661ed05742cd183dc4225949004a60d59487d9771b6789482a71821560b3ffd1c81cdb4d5cd2e289f3843b91bfdb65379810b4200c03778c9e44b22

  • SSDEEP

    98304:Ubtsvkrdch4OslTJ64XIQB3MjkbFw6kzGYn:UJs8rCrsp44XIq3qztn

Malware Config

Signatures

  • DcRat 44 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 14 IoCs
  • Process spawned unexpected child process 42 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 14 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\DCrat.exe
    "C:\Users\Admin\AppData\Local\Temp\DCrat.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\HyperSurrogateContaineragentWin\Trh5bm.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5016
        • C:\HyperSurrogateContaineragentWin\portruntimesvc.exe
          "C:\HyperSurrogateContaineragentWin\portruntimesvc.exe"
          4⤵
          • DcRat
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3872
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WRtY9wpW6j.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:4988
              • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1456
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8d5cb4f-9efc-4f88-87b6-46796977d9b4.vbs"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2780
                  • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                    "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                    8⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3156
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\120dac9a-9cda-45a1-ba36-042b724843f0.vbs"
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:388
                      • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                        "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                        10⤵
                        • UAC bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:4968
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\318c2959-5c16-4e93-b67c-85286f54088f.vbs"
                          11⤵
                          • Suspicious use of WriteProcessMemory
                          PID:644
                          • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                            "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                            12⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:4992
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a9744ec-9a5f-4ef9-b4d0-c79b56ffda0e.vbs"
                              13⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4888
                              • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                14⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                • System policy modification
                                PID:3112
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4edd6f4-7b07-442f-aaa9-a2b55429e04a.vbs"
                                  15⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4188
                                  • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                    "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                    16⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    • System policy modification
                                    PID:3932
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1309b9cf-bb51-4126-b68d-1642f6b84afd.vbs"
                                      17⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3184
                                      • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                        "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                        18⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        • System policy modification
                                        PID:1344
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d8416a4-b30f-45b4-a1a9-83220ff18585.vbs"
                                          19⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4588
                                          • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                            "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                            20⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            • System policy modification
                                            PID:1288
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0eb132b5-5b5e-469f-a479-f9910b07d596.vbs"
                                              21⤵
                                                PID:904
                                                • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                                  "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                                  22⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:5036
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c689aec-21b4-4296-9f27-ca3a74911f75.vbs"
                                                    23⤵
                                                      PID:4612
                                                      • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                                        "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                                        24⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:2204
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a67580c5-5202-47d5-b795-e8e007e87a1b.vbs"
                                                          25⤵
                                                            PID:1800
                                                            • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                                              "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                                              26⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:1416
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\957de2df-1d09-4cb0-8953-597d3e35ef16.vbs"
                                                                27⤵
                                                                  PID:1772
                                                                  • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                                                    "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                                                    28⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:3548
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ec65637-3e22-4336-8c1e-1a4a10e6e311.vbs"
                                                                      29⤵
                                                                        PID:4152
                                                                        • C:\Program Files (x86)\Windows Photo Viewer\upfc.exe
                                                                          "C:\Program Files (x86)\Windows Photo Viewer\upfc.exe"
                                                                          30⤵
                                                                          • Executes dropped EXE
                                                                          PID:4248
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2019ef24-428d-4bda-9921-b9ebb238ae0e.vbs"
                                                                        29⤵
                                                                          PID:2640
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\075a22a4-fa72-4aea-a6f0-6916081c91c6.vbs"
                                                                      27⤵
                                                                        PID:1644
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\876ec5de-4f5c-47fa-9560-35115f6f981e.vbs"
                                                                    25⤵
                                                                      PID:1992
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\789b7756-ecd2-4317-b7c4-8a54cb367d5c.vbs"
                                                                  23⤵
                                                                    PID:2700
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f37bb64-582c-4fca-8081-aa4c6fe6eae8.vbs"
                                                                21⤵
                                                                  PID:4820
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7fbfb2a-97c4-4a4d-a4b7-49702ee2c26e.vbs"
                                                              19⤵
                                                                PID:1036
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72049e0b-b7a3-4e7f-bf7c-159ee1bbebc6.vbs"
                                                            17⤵
                                                              PID:1480
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76619d05-4f98-407f-afb8-6d6247569d14.vbs"
                                                          15⤵
                                                            PID:1936
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0f1e476-88f3-4039-bead-8cb9568a9f36.vbs"
                                                        13⤵
                                                          PID:4372
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b7f5bb4-2b9c-4846-ad71-354a18b5b1f8.vbs"
                                                      11⤵
                                                        PID:544
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a516a436-2875-4b50-8f15-76f5198c5114.vbs"
                                                    9⤵
                                                      PID:4856
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8be32ed3-3b83-4c03-b1ca-71e8281ba38a.vbs"
                                                  7⤵
                                                    PID:4192
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                              4⤵
                                              • Modifies registry key
                                              PID:2700
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\HyperSurrogateContaineragentWin\file.vbs"
                                          2⤵
                                            PID:3048
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:380
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2076
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1084
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\HyperSurrogateContaineragentWin\fontdrvhost.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3064
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2024
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\HyperSurrogateContaineragentWin\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3656
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\DataStore\Registry.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3568
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:404
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\DataStore\Registry.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2272
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4372
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2676
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1316
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\ssh\OfficeClickToRun.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1228
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\ssh\OfficeClickToRun.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4580
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\ssh\OfficeClickToRun.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4072
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\spoolsv.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1288
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3136
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\Tasks\spoolsv.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3860
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4664
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3236
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:740
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\HyperSurrogateContaineragentWin\SearchApp.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4012
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\HyperSurrogateContaineragentWin\SearchApp.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2136
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\HyperSurrogateContaineragentWin\SearchApp.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3880
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\CbsTemp\winlogon.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5036
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\CbsTemp\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3244
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2252
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\taskhostw.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4768
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\taskhostw.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4536
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Package Cache\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}v48.108.8828\taskhostw.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2500
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2876
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4856
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3712
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3604
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4552
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4596
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:876
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3212
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Saved Games\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:392
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\upfc.exe'" /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:5100
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\upfc.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3576
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\upfc.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3916

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\HyperSurrogateContaineragentWin\Trh5bm.bat

                                          Filesize

                                          167B

                                          MD5

                                          44e4cd0532339b7e22611a09c8220999

                                          SHA1

                                          8f742acb720ef17baa41ef700c29a3af5582bef9

                                          SHA256

                                          d4ecf707a041c14ab6e6719b4c0bcdea96c159865ff6ef80fd73de0b26b695c8

                                          SHA512

                                          f10dfda0fc0021f642fc0689a8d217052e50c9e58d1057c2f26005df0433e3af54ac77331d9059746804ddb72589f0e4ec3f50c53b1576efb09134e2aa691809

                                        • C:\HyperSurrogateContaineragentWin\bGPSMCCx73WsREqaBZfJC0ze9BBQbq.vbe

                                          Filesize

                                          214B

                                          MD5

                                          bbd4951dfa4c586309c29313a1acc7b9

                                          SHA1

                                          b16961014ff484fee5c5548506fa9f8786ead667

                                          SHA256

                                          e6a2ee525011550a1508f69a603a3b485e35ec89b9783171cff58a4adccb1fee

                                          SHA512

                                          5a7985a58c283240a7c999521a14a8befe71db33d9023f06a78870c663fefbfeac5b9acafc114937ea44ddffb97bad88c448a0c2d025aa21f73d7941b3aaa50e

                                        • C:\HyperSurrogateContaineragentWin\file.vbs

                                          Filesize

                                          34B

                                          MD5

                                          677cc4360477c72cb0ce00406a949c61

                                          SHA1

                                          b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                                          SHA256

                                          f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                                          SHA512

                                          7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                                        • C:\HyperSurrogateContaineragentWin\portruntimesvc.exe

                                          Filesize

                                          3.4MB

                                          MD5

                                          3ae60214e5dd15829d6380f5dcaac75c

                                          SHA1

                                          c4ff1e0ef5b97b467b28039b3b902b088107ebae

                                          SHA256

                                          1a38cd5a9e8fb8086a6f84ac2bbac0ded061766fcdf3a25a1e6147a400cb8b39

                                          SHA512

                                          816f2e195827abe524d3ffe3c87ee6a5e02289c2fad1a5ed5b5751ecc356998b61b9638c65b7db7f231a3bc50c002995823755650a703cae12aa9decf4c995ac

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\upfc.exe.log

                                          Filesize

                                          1KB

                                          MD5

                                          49b64127208271d8f797256057d0b006

                                          SHA1

                                          b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                          SHA256

                                          2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                          SHA512

                                          f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                        • C:\Users\Admin\AppData\Local\Temp\0eb132b5-5b5e-469f-a479-f9910b07d596.vbs

                                          Filesize

                                          728B

                                          MD5

                                          ad689f9372536ed639d5d00310a8e19d

                                          SHA1

                                          6ef641e1128de14c33107b3e4269edfd6b012abf

                                          SHA256

                                          9fffa5c72f5b416179503a40c33dc8006d6c1f088cdffb6ba338f065dbcfd289

                                          SHA512

                                          41088f4236cd12d18709e328ebffaf96c01020bf6accf0f64373e842e04162de65abeb1f2d1858c868d234ed27f986b7f3c85682a566ff5e8881828b42c63807

                                        • C:\Users\Admin\AppData\Local\Temp\120dac9a-9cda-45a1-ba36-042b724843f0.vbs

                                          Filesize

                                          728B

                                          MD5

                                          1b872949dd2d9ff5a4f0adcb2f11bc27

                                          SHA1

                                          b3279fa5f40fa0f8a415a7dd7fef38d862f86d1d

                                          SHA256

                                          a3b4d39a8090dac9b9f71ce239f8ec108a0f213c815021acefd3a54dd7697a92

                                          SHA512

                                          cf62dc0e1e350d19d8b57590244b11e0e8bff98044fe17a11c1731253f0d0a6e7216eecd0815a698e7bb8bd74d6c4ce653e9e4f0d98ba893e06fba34818261f7

                                        • C:\Users\Admin\AppData\Local\Temp\1309b9cf-bb51-4126-b68d-1642f6b84afd.vbs

                                          Filesize

                                          728B

                                          MD5

                                          3909f808947e65204fc12989175c19c6

                                          SHA1

                                          c76c42f169b2a190b8bb49e9c38e3511bb204b0e

                                          SHA256

                                          24c365a72372279cee278ed74eca248cc3486d2eca4858e304618a45547ef7b4

                                          SHA512

                                          beadc72e6e865b05310129f39af985265765a43f2128b5789757f8aa8f18848d84c90d47a3e1112a909e3f166ad5bb884fe5c684b3fe7b8d1185bb164dd2c8aa

                                        • C:\Users\Admin\AppData\Local\Temp\1a9744ec-9a5f-4ef9-b4d0-c79b56ffda0e.vbs

                                          Filesize

                                          728B

                                          MD5

                                          9e19ec6f833c3ae9faa7607cec992761

                                          SHA1

                                          d87d9c7584d58c5e37e83fa0a274341ad3741ebc

                                          SHA256

                                          3dde36db8a2534e7717b8fe05d3e6eb6add31d9dcf0905bd3392f9da1c2c9df3

                                          SHA512

                                          a4158b12610b42fdc18d52651f4a791825ec0d762a99df8df87ac9db5c09c0ebbcc3fadd26f5486b7a2ef9d8c7eb1d9825fb9641c8073cfce31004c7bb0d5e39

                                        • C:\Users\Admin\AppData\Local\Temp\318c2959-5c16-4e93-b67c-85286f54088f.vbs

                                          Filesize

                                          728B

                                          MD5

                                          e0940d40d1b89af8d3c664bc19370f06

                                          SHA1

                                          a011d5b785d3ea25fe0ac336a8f7a5f8f17479bc

                                          SHA256

                                          e6b9d457f20b843a8395b87a3f140a99a4233e969f8e448bab2056b7f58123ea

                                          SHA512

                                          a6bbc50fb76b5d2c0ab381a0c6494c3975bf6d3b6ebb5c6b64b1e8675f09c35ffb4ecf2082697e82cb6bd8b2c89cd72e660ad4477da3c066623ee0811d178537

                                        • C:\Users\Admin\AppData\Local\Temp\8be32ed3-3b83-4c03-b1ca-71e8281ba38a.vbs

                                          Filesize

                                          504B

                                          MD5

                                          f0320a30969af3b683c7262e19a7115f

                                          SHA1

                                          9b426d68eaa57fa52c51754a973b5b131433e119

                                          SHA256

                                          de590c30611a03c2c0d26d84ca13519e3a0bafd9eca2b09666728c17e4e6705d

                                          SHA512

                                          2a6d9917a3e390427f17b3f5baed5f95b77ffb84277f8f26f6953d13a15cfb05ec27d5e7d8eb8c9eea4d11cb15c4e89ec7689ab1d62d790d4c0ddfc4b38aa99b

                                        • C:\Users\Admin\AppData\Local\Temp\8c689aec-21b4-4296-9f27-ca3a74911f75.vbs

                                          Filesize

                                          728B

                                          MD5

                                          14ab4afd861c2a79fadfb81aee666579

                                          SHA1

                                          448e480f85bbcee026b5e5549a9692633ba89ed2

                                          SHA256

                                          499d4a694b5d2dc468cc274b90bbf9972b9cbcb94eecd1ddee0ffb4ee5ee88c6

                                          SHA512

                                          5022cd7e972f022abd332aed0e1809e2927e4262306d027ffda891e3d1cf33c1b547d764fd1bf0134246ca5c2ca7dabeba7d10786dc7a612c5cce6447b85e27a

                                        • C:\Users\Admin\AppData\Local\Temp\8d8416a4-b30f-45b4-a1a9-83220ff18585.vbs

                                          Filesize

                                          728B

                                          MD5

                                          b19b592f90bc4b74f4aead55bebdbd7f

                                          SHA1

                                          a75f520b56a3c48c5b70f1f67fd7d289c4d9ce3d

                                          SHA256

                                          78eb8c259e1bdd53baab04809a25558410c7f48aa1b55197990b5dd8fafd5c8c

                                          SHA512

                                          d5411ee7fd9b1831918099817c31f9340d76d199e650d25d401fa48848d5416ec318318caa013a36c42cc5906db52569e5af930a735012b10713b0cdd5cf397e

                                        • C:\Users\Admin\AppData\Local\Temp\8ec65637-3e22-4336-8c1e-1a4a10e6e311.vbs

                                          Filesize

                                          728B

                                          MD5

                                          618ea592bd25186343dbec2a8108afcc

                                          SHA1

                                          efa0b65984336f938e727547464932132a36f1c3

                                          SHA256

                                          673e47676dbf890781762d89e78608108d478a17f6bdfdb4d47303e56ca7ee84

                                          SHA512

                                          d9d3bca45f973917eef5f901b60cceec4538809f0d5b5bd5c08528ab810377369fb1284ab31c522af080a0fa3c4575f4832b75b3cad50f188eb0f9e1bbf2981e

                                        • C:\Users\Admin\AppData\Local\Temp\957de2df-1d09-4cb0-8953-597d3e35ef16.vbs

                                          Filesize

                                          728B

                                          MD5

                                          6f295660feaae92f6bb42ca14663f1cf

                                          SHA1

                                          5ee098ce9a23c2738b5508f5ca5eccec4b9d1c86

                                          SHA256

                                          a37a88268862b1eeb817243b84a74d002ac57889ff33e28158fb16557df6495e

                                          SHA512

                                          19ef2bfa5fa7981fdd60265f7c1a17cdc4dee6653e14a000b135842e0fd92b35380c4d69dc326436e897218115a455f30fa0c190b1c2150399162ae21674f8a0

                                        • C:\Users\Admin\AppData\Local\Temp\WRtY9wpW6j.bat

                                          Filesize

                                          217B

                                          MD5

                                          82a86846eb8523f4f37292e3c7c0f9f6

                                          SHA1

                                          1771dbc6e548c600c8fbddb61354f5c998e43ce8

                                          SHA256

                                          ef2322e329f7041d5260790a75da74da38a4e9bc48b572a45882ff70be33c3db

                                          SHA512

                                          29ffeb6ae7a558acdf187360e29c00f7c84b1bcd7d97f525ce8828dc21d16926bbf82d635e6ba96f7280247560fd5f0dbe1c573852198428e8d4cab4198e9a73

                                        • C:\Users\Admin\AppData\Local\Temp\a67580c5-5202-47d5-b795-e8e007e87a1b.vbs

                                          Filesize

                                          728B

                                          MD5

                                          c0ecf564af3ac6a60a1d26cd150d282c

                                          SHA1

                                          b429f96e9ce4fbb4ec9d2d217a0ce9ae78716565

                                          SHA256

                                          942b7901112487466dfa70fd67f28b0a33f2c74e072506dade82fca842ef8147

                                          SHA512

                                          e7d6ac0b469be13219012972a6e4cbf602c11ef79b6346836b4fd122800bc1fe62f68c8fac31b11348aff8e7997db1749cf84ce4b2dd64a2432bf80ad1bc3ee6

                                        • C:\Users\Admin\AppData\Local\Temp\b4edd6f4-7b07-442f-aaa9-a2b55429e04a.vbs

                                          Filesize

                                          728B

                                          MD5

                                          80bd1b89e8f269e70743d597d7183f17

                                          SHA1

                                          19e72eb4693de7413dc6b26e189ee42b16a2a437

                                          SHA256

                                          51909ffd0b64b8e9a4b2deb45d118b3739be8b5ab123b066874fb098dc467800

                                          SHA512

                                          b7337e30474b6f73829ee56632106a5cf6abe4b69367f49f28bfaddaa92ff8a87a3cfaa8be5d3b23bdf694d216091b13005017b14b53f592628b5cfbbfdb52d2

                                        • C:\Users\Admin\AppData\Local\Temp\c8d5cb4f-9efc-4f88-87b6-46796977d9b4.vbs

                                          Filesize

                                          728B

                                          MD5

                                          d19694d1f9c826e642b228c00a9b2674

                                          SHA1

                                          4dce71c316915d6047c2fd781b35866512fcc728

                                          SHA256

                                          8d68d0bc3558ae69742735958c2f1eeeef0282afb5640d28d8723daad6e8ef80

                                          SHA512

                                          624b31b8e84daf556cc9af09bf9b0e10506450c5a5694cc5581efd53a182efab03b01a3e43789e57554c8762d42f7d843a718737faaa2f1b3136107e436ebb04

                                        • memory/1416-208-0x000000001BC60000-0x000000001BC72000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/1456-92-0x0000000003430000-0x0000000003442000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/3112-140-0x000000001B800000-0x000000001B812000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/3872-28-0x000000001C1B0000-0x000000001C1BC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-34-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-37-0x000000001C3E0000-0x000000001C3F2000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/3872-38-0x000000001C940000-0x000000001CE68000-memory.dmp

                                          Filesize

                                          5.2MB

                                        • memory/3872-39-0x000000001C410000-0x000000001C41C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-40-0x000000001C420000-0x000000001C42C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-41-0x000000001C430000-0x000000001C438000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-42-0x000000001C440000-0x000000001C44C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-43-0x000000001C450000-0x000000001C45C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-45-0x000000001C570000-0x000000001C57C000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-44-0x000000001C560000-0x000000001C568000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-46-0x000000001C580000-0x000000001C58A000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/3872-48-0x000000001C6A0000-0x000000001C6A8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-47-0x000000001C690000-0x000000001C69E000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/3872-49-0x000000001C6B0000-0x000000001C6BE000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/3872-50-0x000000001C6C0000-0x000000001C6C8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-51-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-52-0x000000001C6E0000-0x000000001C6E8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-53-0x000000001C7F0000-0x000000001C7FA000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/3872-54-0x000000001C6F0000-0x000000001C6FC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-35-0x000000001C3C0000-0x000000001C3CC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-36-0x000000001C3D0000-0x000000001C3D8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-33-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

                                          Filesize

                                          48KB

                                        • memory/3872-32-0x000000001C350000-0x000000001C3A6000-memory.dmp

                                          Filesize

                                          344KB

                                        • memory/3872-31-0x000000001C340000-0x000000001C34A000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/3872-30-0x000000001C330000-0x000000001C340000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3872-17-0x0000000000B90000-0x0000000000EFA000-memory.dmp

                                          Filesize

                                          3.4MB

                                        • memory/3872-29-0x000000001C320000-0x000000001C328000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-18-0x00000000016F0000-0x00000000016FE000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/3872-27-0x000000001C310000-0x000000001C322000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/3872-25-0x000000001C180000-0x000000001C196000-memory.dmp

                                          Filesize

                                          88KB

                                        • memory/3872-26-0x000000001C1A0000-0x000000001C1A8000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-19-0x0000000001710000-0x000000000171E000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/3872-23-0x0000000001730000-0x0000000001738000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3872-24-0x000000001C170000-0x000000001C180000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3872-22-0x000000001C1C0000-0x000000001C210000-memory.dmp

                                          Filesize

                                          320KB

                                        • memory/3872-21-0x000000001C150000-0x000000001C16C000-memory.dmp

                                          Filesize

                                          112KB

                                        • memory/3872-20-0x0000000001720000-0x0000000001728000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/3932-152-0x000000001C430000-0x000000001C442000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4968-116-0x000000001BE00000-0x000000001BE12000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4992-128-0x000000001BD70000-0x000000001BD82000-memory.dmp

                                          Filesize

                                          72KB