Overview

overview

10

Static

static

10

f08bab568e...d1.exe

windows7-x64

10

f08bab568e...d1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-01-2025 03:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe

  • Size

    2.2MB

  • MD5

    67f998093c11d8a104aef7a92a2d5b26

  • SHA1

    cea4392bfb620e2d5b303c7f39fe68a30080a771

  • SHA256

    f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1

  • SHA512

    e3572eaf810f95944206728a83c822244afd079f59cef2911e11dddd85216a09663edbd8041fe5281c0ca9a6182bc5b70d77cbcc403baccbfbdc1d9c6a137e92

  • SSDEEP

    49152:AsSHlG56vO0T3/Nh/ptuw/C3TqGaDxr1NcWTMUvif:ALlK6d3/Nh/bV/Oq3Dxp2RUG

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 28 IoCs
    persistence
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 15 IoCs
    evasiontrojan
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 56 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 10 IoCs
    evasiontrojan
  • Drops file in Program Files directory 55 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • System policy modification 1 TTPs 15 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
    "C:\Users\Admin\AppData\Local\Temp\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4804
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OjIocmwsYG.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:3548
        • C:\Users\Admin\AppData\Local\Temp\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe
          "C:\Users\Admin\AppData\Local\Temp\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe"
          3⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2752
          • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe
            "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe"
            4⤵
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2252
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c4ea6a9-a751-477c-9f38-2d041ad1d131.vbs"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4668
              • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe
                "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe"
                6⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:4732
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe486a2c-e687-40d4-9a72-7d379aa169a3.vbs"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2380
                  • C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe
                    "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe"
                    8⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1780
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0488e9fe-cd3f-46aa-964a-33d4e465bdbd.vbs"
                      9⤵
                        PID:1812
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ec2f1fd-6827-4d1f-9b58-1d62f2dd1c08.vbs"
                        9⤵
                          PID:3116
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3e47d7c-b9ec-4f75-aab7-635b916d37f9.vbs"
                      7⤵
                        PID:464
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76f5b4be-cbe7-471b-8175-613e57bde948.vbs"
                    5⤵
                      PID:4044
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3420
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5000
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3128
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:2440
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4580
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              PID:2776
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4876
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:3564
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:724
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2508
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:744
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:512
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4208
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2092
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:216
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4668
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4188
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4108
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2640
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:4868
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2864
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\smss.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:1448
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:5080
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2180
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1328
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2404
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2444
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:4364
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:756
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4432
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\wininit.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:3992
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\tracing\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1764
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1952
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:2908
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3372
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1608
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\WaaSMedicAgent.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:960
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\WaaSMedicAgent.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1520
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\WaaSMedicAgent.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2068
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5076
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2012
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1416
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Registry.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1612
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Registry.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2060
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\Registry.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3404
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\sysmon.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2584
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2756
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3680
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3316
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3652
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:4272
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:724
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2108
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:552
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3600
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1932
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2092
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\unsecapp.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4668
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Public\Music\unsecapp.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              PID:216
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\unsecapp.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4164
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Windows\Performance\WinSAT\sysmon.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:816
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:468
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:1356
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1040
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Scheduled Task/Job: Scheduled Task
              PID:4692
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Scheduled Task/Job: Scheduled Task
              PID:948
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\lsass.exe'" /f
              1⤵
              • DcRat
              PID:2404
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\lsass.exe'" /rl HIGHEST /f
              1⤵
                PID:4880
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\lsass.exe'" /rl HIGHEST /f
                1⤵
                • DcRat
                • Scheduled Task/Job: Scheduled Task
                PID:3640
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /f
                1⤵
                • DcRat
                PID:4556
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f
                1⤵
                • DcRat
                PID:3272
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f
                1⤵
                • DcRat
                • Scheduled Task/Job: Scheduled Task
                PID:4544
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\SppExtComObj.exe'" /f
                1⤵
                • DcRat
                • Scheduled Task/Job: Scheduled Task
                PID:964
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\SppExtComObj.exe'" /rl HIGHEST /f
                1⤵
                • DcRat
                • Scheduled Task/Job: Scheduled Task
                PID:4944
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\SppExtComObj.exe'" /rl HIGHEST /f
                1⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4740
              • C:\Windows\system32\schtasks.exe
                schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe'" /f
                1⤵
                  PID:1668
                • C:\Windows\system32\schtasks.exe
                  schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
                  1⤵
                    PID:5036
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:4216
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:3196
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:668
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:4980
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:4904
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:624
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • DcRat
                    • Scheduled Task/Job: Scheduled Task
                    PID:64

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  4
                  T1112

                  Credential Access

                  Discovery

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  3
                  T1082

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RCXA6A5.tmp
                    Filesize

                    2.2MB

                    MD5

                    70f35d04041d9c029d59586fc6aa3819

                    SHA1

                    a9f37462584d22bad8909ffc1c047cdfee84f049

                    SHA256

                    517ef97c6f4481e5d6eac2ebd79fbbfe34c9dbe59a0f775c0c2a3e3b942aaae6

                    SHA512

                    1739c6ce05e4fbee9d2829a95b3ca910b28a0f853d2a6e11e779fae7b419c46b7fd22641f28c2b91b826dd3905e478a23fa1e55c31665adea3f6a042d7078f53

                    Download Submit

                  • C:\Program Files\Mozilla Firefox\uninstall\wininit.exe
                    Filesize

                    2.2MB

                    MD5

                    d157ea5f456aecf396e1c58f2e4cdfbe

                    SHA1

                    1db616d933bc6e1fba364bf52cb1b76bd7e778c7

                    SHA256

                    a26f4030fe8872a6104246d4fab682bceb1dd19d8bb08ec9e203f7cdc6d35760

                    SHA512

                    c95d06369e464a8a62c35c1ecab2b54bc8adc409ab689adfe5d9b9dc6d845bd51a785c17234c61e1dfb14a3271fd78ecf9c229553605976f72bccb0b053d7578

                    Download Submit

                  • C:\Recovery\WindowsRE\e1ef82546f0b02
                    Filesize

                    804B

                    MD5

                    9f99948b74d56a781081a3a79dee69e0

                    SHA1

                    6b841663f17d708cc071a6f173252c50ad629c06

                    SHA256

                    26917c93a509a4aeb99187cd6a2e0aebc024d7719dd32aadcf81fcc100b3b6a4

                    SHA512

                    14b992db2fa3a34fb740b012d56b7c599ef2f8eb00796c5b08f7a40d411861764b219a7a60cb91d0fa47810d30a486f3d405c5f24b92c1a58468e65df6a995d6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1.exe.log
                    Filesize

                    1KB

                    MD5

                    655010c15ea0ca05a6e5ddcd84986b98

                    SHA1

                    120bf7e516aeed462c07625fbfcdab5124ad05d3

                    SHA256

                    2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14

                    SHA512

                    e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
                    Filesize

                    1KB

                    MD5

                    49b64127208271d8f797256057d0b006

                    SHA1

                    b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                    SHA256

                    2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                    SHA512

                    f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\0488e9fe-cd3f-46aa-964a-33d4e465bdbd.vbs
                    Filesize

                    760B

                    MD5

                    ef31fd3373bccef69f262f8af3413b3b

                    SHA1

                    de32e893a740de6991b230f3107970628fc43f19

                    SHA256

                    6a07441da47a9025fd49920aaa5eaf6505ecb9f4bba4a2090b5b54970212d9e3

                    SHA512

                    a879896d33556c4a2ed648be97f4b523e8f49949a4d16b4dd6ad615d72e9e5168d58f3ccfb34d3471be7de1bda9cb08152cb4b434cf91a755606ed5a691321e0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\6c4ea6a9-a751-477c-9f38-2d041ad1d131.vbs
                    Filesize

                    760B

                    MD5

                    eda228ced05fc65e972bf51e85c3d9bc

                    SHA1

                    901b44e989387efcb64499d11d244234cb5dcd9a

                    SHA256

                    faca813bc19bae2233e3600fc73ea5185a91327604df2d1328e8298f1e0bd07d

                    SHA512

                    c030c295f0559315a2dd0059e20d37bbe2a3cbb6d3ae0c7c06d9f1d865d5cba8feaa35f3b7184a4610a0a6beb0c5303fde1d836d13a3c4fa8208aed62f018e79

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\76f5b4be-cbe7-471b-8175-613e57bde948.vbs
                    Filesize

                    536B

                    MD5

                    89fefc2fd577daf25874c9b2ec22b243

                    SHA1

                    716ecc5dcaab83dd7698079cb965c0902eafc9ca

                    SHA256

                    3578ab20b59fe2b2c0ad5b0fcc7d27e9f615da7cd194bc2646705e0ddc7a9e09

                    SHA512

                    d9ccd72cc5c71dbdaa07ac3c95a516911a0362c8b325893b7ffa03c4301ec388bc7cebdb51faa0cd43edef49b2864d1274e625590d583eebea0b7fc12b900870

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\OjIocmwsYG.bat
                    Filesize

                    267B

                    MD5

                    0d42da9fec7aeb7e3a3ed5f44b626c97

                    SHA1

                    2a66149c232922520cd75e2035fd4a664703abfc

                    SHA256

                    044b004d433ced5ad1695870a11e4b1458b85174629310099e202e53675430ed

                    SHA512

                    5b21e6576be6971b0f53192d934ba76b188bf93d6d46a46ba1f5792d331e57cfab964d1d89da1a4e8c636340c81c01a286e1f744f37f3e278c74895b462a3a61

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\fe486a2c-e687-40d4-9a72-7d379aa169a3.vbs
                    Filesize

                    760B

                    MD5

                    a4f3d8dd59b443fce2da6347dea91cce

                    SHA1

                    bf0fc1b5f7fe800b9454806bc09dc4a0b95980f0

                    SHA256

                    31ed7af699ba15bb423564ae5793450d9e5fbab630e5a94bf3680f50a20c1a93

                    SHA512

                    71aaf564c453be3230be802b69406485fc2844ddc32e9105941f3138d405f7eff4f2b687755a8c9a6c629e333e37f3fa781bc0e447cc33a135e5265f36be398f

                    Download Submit

                  • C:\Users\Public\Libraries\dllhost.exe
                    Filesize

                    2.2MB

                    MD5

                    67f998093c11d8a104aef7a92a2d5b26

                    SHA1

                    cea4392bfb620e2d5b303c7f39fe68a30080a771

                    SHA256

                    f08bab568e1877365870d1d321bb77c1e6e36f5f91b29e73c7c33d13a01c31d1

                    SHA512

                    e3572eaf810f95944206728a83c822244afd079f59cef2911e11dddd85216a09663edbd8041fe5281c0ca9a6182bc5b70d77cbcc403baccbfbdc1d9c6a137e92

                    Download Submit

                  • memory/4804-11-0x0000000002ED0000-0x0000000002ED8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/4804-29-0x000000001C3F0000-0x000000001C3F8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/4804-13-0x0000000002EF0000-0x0000000002EFA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/4804-14-0x000000001B940000-0x000000001B94C000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-15-0x000000001B950000-0x000000001B958000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/4804-16-0x000000001B960000-0x000000001B96C000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-17-0x000000001B970000-0x000000001B978000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/4804-19-0x000000001B980000-0x000000001B992000-memory.dmp

                    Filesize

                    72KB

                    Download

                  • memory/4804-20-0x000000001C690000-0x000000001CBB8000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/4804-21-0x000000001B9B0000-0x000000001B9BC000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-22-0x000000001B9C0000-0x000000001B9CC000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-28-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-25-0x000000001C270000-0x000000001C27E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/4804-23-0x000000001B9D0000-0x000000001B9DC000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-27-0x000000001C390000-0x000000001C39E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/4804-26-0x000000001C280000-0x000000001C288000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/4804-24-0x000000001C260000-0x000000001C26A000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/4804-12-0x0000000002EE0000-0x0000000002EF0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4804-31-0x00007FF8BE710000-0x00007FF8BF1D1000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4804-30-0x000000001C400000-0x000000001C40C000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-34-0x00007FF8BE710000-0x00007FF8BF1D1000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4804-0-0x00007FF8BE713000-0x00007FF8BE715000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/4804-7-0x0000000002E80000-0x0000000002E88000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/4804-9-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/4804-160-0x00007FF8BE713000-0x00007FF8BE715000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/4804-167-0x00007FF8BE710000-0x00007FF8BF1D1000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4804-10-0x0000000002EC0000-0x0000000002ECC000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/4804-8-0x0000000002E90000-0x0000000002EA0000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/4804-6-0x000000001B8F0000-0x000000001B940000-memory.dmp

                    Filesize

                    320KB

                    Download

                  • memory/4804-5-0x0000000002E60000-0x0000000002E7C000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/4804-4-0x0000000001460000-0x000000000146E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/4804-3-0x0000000001450000-0x000000000145E000-memory.dmp

                    Filesize

                    56KB

                    Download

                  • memory/4804-2-0x00007FF8BE710000-0x00007FF8BF1D1000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4804-1-0x0000000000A00000-0x0000000000C2E000-memory.dmp

                    Filesize

                    2.2MB

                    Download