Overview

overview

10

Static

static

10

d1a77a1cb9...f0.exe

windows7-x64

10

d1a77a1cb9...f0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 02:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe

  • Size

    3.7MB

  • MD5

    b0f05d80b12c67dc9d26fe6d4f0debd0

  • SHA1

    9bf6fee145f08c3ea7d41e6f6755187e92f11978

  • SHA256

    d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0

  • SHA512

    19632526b95ea7435c05af10ceb74179e902201389c62476c7cd5281a5dea338283921166a2272cbe12caf58b2207b18b58834b5c2b1c17df87b2f83fc3824d9

  • SSDEEP

    98304:UbF26GgA01Iz8pS1m+j/C7N2DXXrbpqto0:U1A6IIAY+j6pG/Yb

Score
10/10
dcratdiscoveryevasioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 54 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 30 IoCs
    evasiontrojan
  • DCRat payload 11 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 20 IoCs
    evasiontrojan
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 30 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe
    "C:\Users\Admin\AppData\Local\Temp\d1a77a1cb9e4123494d9646d4d064289d6c96dd7a1ebde4dc0aab169c42018f0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\MssurrogateBrowserDrivermonitor\wcYORPbCatQJR5AFuaKjs.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\MssurrogateBrowserDrivermonitor\Qi30CUagccjw.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\MssurrogateBrowserDrivermonitor\reviewnet.exe
          "C:\MssurrogateBrowserDrivermonitor\reviewnet.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2972
          • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
            "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
            5⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3036
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5a7deb3-3f79-4cf2-9384-06cb36355e1a.vbs"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3048
              • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                7⤵
                • UAC bypass
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2632
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3991bd21-87b5-484d-948f-f98aabc95603.vbs"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2312
                  • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                    9⤵
                    • UAC bypass
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2816
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\378bb2c9-ff33-490e-81e0-68ead3b7be31.vbs"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1676
                      • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                        11⤵
                        • UAC bypass
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:2568
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30455696-8696-42e7-919d-a35854a542ae.vbs"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2368
                          • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                            "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                            13⤵
                            • UAC bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:2436
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f36027ed-367f-4ae7-9913-cee9018143dc.vbs"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2344
                              • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                                "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                                15⤵
                                • UAC bypass
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Suspicious use of AdjustPrivilegeToken
                                • System policy modification
                                PID:1828
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dda49b71-2a54-4c38-b11c-1b9afa295148.vbs"
                                  16⤵
                                    PID:1744
                                    • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                                      "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                                      17⤵
                                      • UAC bypass
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Suspicious use of AdjustPrivilegeToken
                                      • System policy modification
                                      PID:1696
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fad24a81-373d-49bf-ab42-1ae92e215647.vbs"
                                        18⤵
                                          PID:2792
                                          • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                                            "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                                            19⤵
                                            • UAC bypass
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:324
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcf9aa0b-9a1a-4d5e-80f2-39212d6dc398.vbs"
                                              20⤵
                                                PID:2064
                                                • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe
                                                  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe"
                                                  21⤵
                                                  • UAC bypass
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:2676
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b3362ea-8426-4be1-8aab-146ac5849813.vbs"
                                                    22⤵
                                                      PID:2072
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6933da4-24eb-4065-81eb-0dadd962f051.vbs"
                                                      22⤵
                                                        PID:2680
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dadf2ef6-d8f1-4d2e-a57b-c8b963e21768.vbs"
                                                    20⤵
                                                      PID:1832
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc958c41-ec1a-4ac2-8467-a3e195b574b2.vbs"
                                                  18⤵
                                                    PID:1724
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5135b10-134e-4b0e-aaac-45ddea419988.vbs"
                                                16⤵
                                                  PID:2044
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac1b17dc-5e4b-40a2-b733-e9fe1aa369ab.vbs"
                                              14⤵
                                                PID:2572
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44f25fec-66db-4758-b98d-7bc5c4fe60bb.vbs"
                                            12⤵
                                              PID:2236
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34cc2692-50fa-49bf-9266-a0065346f32c.vbs"
                                          10⤵
                                            PID:580
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e037a769-ad57-474d-b0ed-661ec38838ce.vbs"
                                        8⤵
                                          PID:2652
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c482462-6004-4cae-aa04-974bee14251f.vbs"
                                      6⤵
                                        PID:2028
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\MssurrogateBrowserDrivermonitor\file.vbs"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2212
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1444
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1612
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\taskhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1104
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\OSPPSVC.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1484
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\OSPPSVC.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:524
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\OSPPSVC.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2684
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2252
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1792
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\explorer.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1264
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:108
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:112
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:860
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\services.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1600
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\services.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:572
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\services.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1884
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\conhost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:944
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\conhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2404
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\conhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2424
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Favorites\taskhost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1588
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Favorites\taskhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:888
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Favorites\taskhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:924
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Start Menu\OSPPSVC.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1048
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\OSPPSVC.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2144
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Start Menu\OSPPSVC.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2108
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Adobe\Updater6\winlogon.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1460
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Updater6\winlogon.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1968
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\Updater6\winlogon.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1124
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\My Documents\conhost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2848
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\conhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2332
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\conhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1756
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\csrss.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1948
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SchCache\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2748
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\SchCache\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1100
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2320
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1072
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dwm.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:876
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\services.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2276
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\services.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1908
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\services.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1648
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2704
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2116
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Idle.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2980
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\lsm.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:3020
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Downloads\lsm.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:3004
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\lsm.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2564
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\audiodg.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2184
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\es-ES\audiodg.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2212
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\audiodg.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2164
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MssurrogateBrowserDrivermonitor\csrss.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:3052
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MssurrogateBrowserDrivermonitor\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2832
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MssurrogateBrowserDrivermonitor\csrss.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2612
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2808
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2760
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2304

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\MssurrogateBrowserDrivermonitor\Qi30CUagccjw.bat
                              Filesize

                              50B

                              MD5

                              934b57a6b87ad62fbf72805fc7ed30d0

                              SHA1

                              04111b17e6b836077bca5c092dfd4e59657fbfae

                              SHA256

                              25bfd4297df8354c427f96c5569594300935745c03f15aa1e4097cff1be3f70d

                              SHA512

                              5737cbaa48b1c5804072681e58e8e9d55aa7d996614dd3ff6501afaea693aca3fe7275a811c7aad1bbb88057fea7a31a393cadf7c2761aeca32e1e1f83940b07

                              Download Submit

                            • C:\MssurrogateBrowserDrivermonitor\file.vbs
                              Filesize

                              34B

                              MD5

                              677cc4360477c72cb0ce00406a949c61

                              SHA1

                              b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

                              SHA256

                              f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

                              SHA512

                              7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

                              Download Submit

                            • C:\MssurrogateBrowserDrivermonitor\wcYORPbCatQJR5AFuaKjs.vbe
                              Filesize

                              220B

                              MD5

                              b7946fc546ca743f534d88dddeee3f00

                              SHA1

                              668ed69a0b7a298e08a68e80161f7eeead3128a5

                              SHA256

                              8673980ed61a75db17016d3fe892f2c37ddc037f34032e2fd35626ed146d80d2

                              SHA512

                              7ee3cec4df1a0b2c5984ccf860a004dcaa3c3fa258370edabb50ccd3f92a8d3ab8daf1af1f5087a67a24bf285a34b040f36d7673f1f8e413dc931a201967712a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\2c482462-6004-4cae-aa04-974bee14251f.vbs
                              Filesize

                              540B

                              MD5

                              18a53d7b0153268113375d90a052227d

                              SHA1

                              9cc0564ddf54b5bfc52bedc16b71f3262f2f4ff8

                              SHA256

                              45e74a8f87c92afc61afe83244c1bc978c6428e60fe084688322635994779768

                              SHA512

                              52968a3e952f742b665431ed1c6eebe7209c887fa6e04104be36df104a9f07f7e4ef9337cc0bc492799550197df5593a0cf5551f55e845ae7272ab5bd47ea88c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\30455696-8696-42e7-919d-a35854a542ae.vbs
                              Filesize

                              764B

                              MD5

                              25162239721443dbf5de49ae66d80b84

                              SHA1

                              0143c3d6b34678a82d9ea23b14512f3690539941

                              SHA256

                              d5d8f6496dbdab6dff3a3863e68e30abb72034caf168a667e87ea0258c815b76

                              SHA512

                              c4f93694dd57f464ae2fc610a788432dbc4865a78985c5a95a91dfe77fe4bbb40d210eded9edee3cbf4c77e24bd08c1b47b90b1f6b1c4b528ab7a13d6c37d8d5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\378bb2c9-ff33-490e-81e0-68ead3b7be31.vbs
                              Filesize

                              764B

                              MD5

                              6a2c5b0731de50deae90f8888e9ed9ca

                              SHA1

                              781e13a34a71342616f7c770ab92ad45ebd33d0c

                              SHA256

                              0647dc1c7b1f26b275663898ee3e2fc8ee559f768796ee61fcae0aafb5449ed5

                              SHA512

                              70aae1886e25fc5d26821f160e23426f19ca30758b04938ad26395ff29b5ad18044c2833ba2a2aa77c4bd94066d20959f9dce9bda60522d3f794782ad2ddf143

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\3991bd21-87b5-484d-948f-f98aabc95603.vbs
                              Filesize

                              764B

                              MD5

                              b7c03c8e84af8480a7f2b6a1995bc310

                              SHA1

                              cd26dc2b7ed9bd6726b2c61c9add3d48e94c952a

                              SHA256

                              0c1a6e70340b547e95dcf95ac88dba85cae3ef98bb204afb318d625fa8d80aa4

                              SHA512

                              71d70c48dcab018cd01dea115103018e2e328e36091044ab589d97db3827d7b801d09a69756f31bbf0697aa73c8eea2ce79b0ec25865524794f3f9e2dcc2fea7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\5b3362ea-8426-4be1-8aab-146ac5849813.vbs
                              Filesize

                              764B

                              MD5

                              66ef1093323427698735b46569d3c91a

                              SHA1

                              e563c1e93f8c93b06d289f586049ae82bf7f798f

                              SHA256

                              ae5e395cff6fc6ff81d60c8f0c4ad8be9ac6eceff74b66456e3568d510445cd0

                              SHA512

                              43d2c4fb2b751a8eee29b4e431f649f5feee32edc0924657a677b2956c2909b6e29ebc61433af5417310b18a8bcf1e9d6c8b5e2869a350ecda640ef56a696cac

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\dcf9aa0b-9a1a-4d5e-80f2-39212d6dc398.vbs
                              Filesize

                              763B

                              MD5

                              08905b7063620537acad08967200da38

                              SHA1

                              9b7e0ea3102d42da639cbe91841e347441152e23

                              SHA256

                              94674c55b374c71daf063b0d4a35f8e4a0903d66e455eab0518a595181a6701e

                              SHA512

                              940cf6d4cc81f60f2128fe05ba09b175d4e43dab1973f53857220457de6ee24d51d90ec310a325321b13ff624fc38437b3087bc93093b36714fe2afffb1481fb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\dda49b71-2a54-4c38-b11c-1b9afa295148.vbs
                              Filesize

                              764B

                              MD5

                              81cf2e7a09b5c12585cd87d1793b9690

                              SHA1

                              3ac671dc4f3a931daa546732008c3da2037b0019

                              SHA256

                              839bee150ab96e378acbc310eef5ec10a9c954ce81b4af2493c911712264f480

                              SHA512

                              33e0f29789a17114df080bf00595d26567b41918c489caec238d4c8802de8d1462eff1001d7686d173c5e81a852a72885c40b9502113db76f5fed2a6b81a7350

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\f36027ed-367f-4ae7-9913-cee9018143dc.vbs
                              Filesize

                              764B

                              MD5

                              978caffda5d43150f1659002074b9550

                              SHA1

                              beb201dddefd14c4c95eeafb061f01296bcda48b

                              SHA256

                              60e628cc72357587441582997826f15dc7e57c6e3b5eaf7084517a3d829e7cfb

                              SHA512

                              5687eadcc759128cc36e93b94d926763a54465922fb5ce734f41be2b3c489f6716bc5fe7ef6c27d138f0935dcbac2f61515d30e1095fe8905e713163013facfe

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\f5a7deb3-3f79-4cf2-9384-06cb36355e1a.vbs
                              Filesize

                              764B

                              MD5

                              713bc815726672372993c97f8db6d07e

                              SHA1

                              20139d235ea37a8353e570b8592a403fddc12a16

                              SHA256

                              d8ec1b87837cec128813cd759871d7934a7794f3e661d9aee0b1fee063e703d8

                              SHA512

                              5bc017d0087e54d9aa267903789fd0f8c446cbd77b3a5d7be8b985847fa2f37ad54e465c70fb291e2523b13d669969145f6573ddecf500a1de49f73dc41065d9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\fad24a81-373d-49bf-ab42-1ae92e215647.vbs
                              Filesize

                              764B

                              MD5

                              3f9380905d626f32bd87e52d1d4add9c

                              SHA1

                              6f3a3e29e8e6ba6aed943579838d2ab541b7ce52

                              SHA256

                              c9542425e86ffef3554d5646f996fcecb018e66a19823bc296b9c5948f195653

                              SHA512

                              2e7e5f0e2a2e3dfd0cf0d7110215cf1653d8b948857ff67d1fa9657220c95f6c5d3590472ed1c5728b3a6aac9cf85f74bf4649bdfad1ba90a4814950df354524

                              Download Submit

                            • \MssurrogateBrowserDrivermonitor\reviewnet.exe
                              Filesize

                              3.4MB

                              MD5

                              7d995f38d429ff33eaf4ce89f60585f9

                              SHA1

                              160f3163b335110d718e98390add6ca7a110a8ca

                              SHA256

                              49877051396a67dc531bb04d9745c78820a04e21ab3a6071906739ef48098b68

                              SHA512

                              61cb35e8469cd396b8487ca31542d0f505179283aa7d645344f2de7ffa47cfda0013bdfa2c5b29edd16978bce9a90fe2795a62e3dd4b900d9db5431b2d81f887

                              Download Submit

                            • memory/324-184-0x0000000000360000-0x00000000006CA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/1696-172-0x00000000005F0000-0x0000000000602000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/1696-171-0x0000000001380000-0x00000000016EA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/1828-159-0x0000000000F50000-0x00000000012BA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2436-145-0x0000000000EF0000-0x000000000125A000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2436-146-0x0000000000C40000-0x0000000000C52000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2436-147-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2568-133-0x0000000000AD0000-0x0000000000E3A000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2632-109-0x0000000000F10000-0x0000000000F22000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2632-108-0x0000000001270000-0x00000000015DA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2676-196-0x0000000000E90000-0x00000000011FA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2676-197-0x0000000000E80000-0x0000000000E92000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2816-121-0x0000000000280000-0x00000000005EA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2972-30-0x0000000000790000-0x00000000007A0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/2972-37-0x00000000024C0000-0x00000000024D2000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2972-43-0x000000001ACD0000-0x000000001ACD8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-44-0x000000001ACE0000-0x000000001ACEC000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-45-0x000000001ACF0000-0x000000001ACFA000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2972-46-0x000000001AD00000-0x000000001AD0E000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/2972-47-0x000000001AD10000-0x000000001AD18000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-48-0x000000001AD20000-0x000000001AD2E000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/2972-49-0x000000001AE30000-0x000000001AE38000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-50-0x000000001B210000-0x000000001B21C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-51-0x000000001B220000-0x000000001B228000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-52-0x000000001B230000-0x000000001B23A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2972-53-0x000000001B240000-0x000000001B24C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-18-0x0000000000870000-0x0000000000BDA000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/2972-19-0x00000000001C0000-0x00000000001CE000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/2972-41-0x0000000002830000-0x000000000283C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-40-0x0000000002820000-0x0000000002828000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-39-0x0000000002810000-0x000000000281C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-38-0x00000000024D0000-0x00000000024DC000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-42-0x0000000002840000-0x000000000284C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-36-0x0000000000860000-0x0000000000868000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-35-0x0000000000850000-0x000000000085C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-34-0x0000000000840000-0x0000000000848000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-33-0x00000000007B0000-0x00000000007BC000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-32-0x0000000002470000-0x00000000024C6000-memory.dmp

                              Filesize

                              344KB

                              Download

                            • memory/2972-31-0x00000000007A0000-0x00000000007AA000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2972-29-0x00000000005D0000-0x00000000005D8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-28-0x0000000000780000-0x000000000078C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2972-27-0x0000000000760000-0x0000000000772000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2972-26-0x00000000003D0000-0x00000000003D8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-25-0x00000000003B0000-0x00000000003C6000-memory.dmp

                              Filesize

                              88KB

                              Download

                            • memory/2972-23-0x00000000002F0000-0x00000000002F8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-24-0x00000000003A0000-0x00000000003B0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/2972-22-0x0000000000380000-0x000000000039C000-memory.dmp

                              Filesize

                              112KB

                              Download

                            • memory/2972-21-0x00000000001E0000-0x00000000001E8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2972-20-0x00000000001D0000-0x00000000001DE000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/3036-97-0x0000000000E70000-0x0000000000E82000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/3036-96-0x0000000000E80000-0x00000000011EA000-memory.dmp

                              Filesize

                              3.4MB

                              Download