dcrat | c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe
Size

1.3MB
MD5

e3962cc8f195a88d04017115b5fb760b
SHA1

08cff0e69a811f82bb87eff43db89963923d457d
SHA256

c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238
SHA512

5e27768541f069a6640c51fbec028320d87f12279525501b8d74cec41c3991f84080346c84b471827e8bb022d903389e6f5425035c3974f9650f8984d09e4cf4
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	176	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	3756	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	3756	schtasks.exe	43

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000021b43-137.dat	dcrat
behavioral1/files/0x0002000000021b43-138.dat	dcrat
behavioral1/memory/2892-139-0x00000000007F0000-0x0000000000900000-memory.dmp	dcrat
behavioral1/files/0x0007000000022e09-203.dat	dcrat
behavioral1/files/0x0007000000022e09-202.dat	dcrat
behavioral1/files/0x0007000000022e09-211.dat	dcrat
behavioral1/files/0x0007000000022e09-219.dat	dcrat
behavioral1/files/0x0007000000022e09-226.dat	dcrat
behavioral1/files/0x0007000000022e09-233.dat	dcrat
behavioral1/files/0x0007000000022e09-240.dat	dcrat
behavioral1/files/0x0007000000022e09-247.dat	dcrat
behavioral1/files/0x0007000000022e09-254.dat	dcrat
behavioral1/files/0x0007000000022e09-261.dat	dcrat

Executes dropped EXE 10 IoCs

pid	Process
2892	DllCommonsvc.exe
4800	StartMenuExperienceHost.exe
3272	StartMenuExperienceHost.exe
3464	StartMenuExperienceHost.exe
1216	StartMenuExperienceHost.exe
3812	StartMenuExperienceHost.exe
4492	StartMenuExperienceHost.exe
1516	StartMenuExperienceHost.exe
4312	StartMenuExperienceHost.exe
780	StartMenuExperienceHost.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\SIHClient.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\fr-FR\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\taskhostw.exe	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ShellExperiences\55b276f4edf653	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\ShellExperiences\StartMenuExperienceHost.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\ShellExperiences\StartMenuExperienceHost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4728	schtasks.exe
3624	schtasks.exe
1008	schtasks.exe
1716	schtasks.exe
1000	schtasks.exe
1948	schtasks.exe
4316	schtasks.exe
3408	schtasks.exe
1992	schtasks.exe
4784	schtasks.exe
3392	schtasks.exe
4080	schtasks.exe
1244	schtasks.exe
4520	schtasks.exe
5108	schtasks.exe
1964	schtasks.exe
4484	schtasks.exe
2392	schtasks.exe
1988	schtasks.exe
176	schtasks.exe
4192	schtasks.exe
3568	schtasks.exe
616	schtasks.exe
1704	schtasks.exe
4796	schtasks.exe
3840	schtasks.exe
2284	schtasks.exe
976	schtasks.exe
4924	schtasks.exe
3528	schtasks.exe
3768	schtasks.exe
2592	schtasks.exe
2256	schtasks.exe
1956	schtasks.exe
4792	schtasks.exe
3180	schtasks.exe
208	schtasks.exe
1852	schtasks.exe
5096	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
2892	DllCommonsvc.exe
3232	powershell.exe
3232	powershell.exe
4712	powershell.exe
4712	powershell.exe
1328	powershell.exe
1328	powershell.exe
2644	powershell.exe
2644	powershell.exe
980	powershell.exe
980	powershell.exe
1124	powershell.exe
1124	powershell.exe
2764	powershell.exe
2764	powershell.exe
4680	powershell.exe
4680	powershell.exe
4304	powershell.exe
4304	powershell.exe
2516	powershell.exe
2516	powershell.exe
948	powershell.exe
948	powershell.exe
2516	powershell.exe
4492	powershell.exe
4492	powershell.exe
736	powershell.exe
736	powershell.exe
2600	powershell.exe
2600	powershell.exe
1124	powershell.exe
948	powershell.exe
3232	powershell.exe
2644	powershell.exe
1328	powershell.exe
4712	powershell.exe
980	powershell.exe
4680	powershell.exe
2764	powershell.exe
4304	powershell.exe
736	powershell.exe
4492	StartMenuExperienceHost.exe
2600	powershell.exe
4800	StartMenuExperienceHost.exe
3272	StartMenuExperienceHost.exe
3464	StartMenuExperienceHost.exe
1216	StartMenuExperienceHost.exe
3812	StartMenuExperienceHost.exe
4492	StartMenuExperienceHost.exe
1516	StartMenuExperienceHost.exe
4312	StartMenuExperienceHost.exe
780	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	DllCommonsvc.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	4800	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3272	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3464	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1216	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3812	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4492	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1516	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4312	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	780	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4244	3272	c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe	80
PID 3272 wrote to memory of 4244	3272	c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe	80
PID 3272 wrote to memory of 4244	3272	c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe	80
PID 4244 wrote to memory of 2376	4244	WScript.exe	82
PID 4244 wrote to memory of 2376	4244	WScript.exe	82
PID 4244 wrote to memory of 2376	4244	WScript.exe	82
PID 2376 wrote to memory of 2892	2376	cmd.exe	84
PID 2376 wrote to memory of 2892	2376	cmd.exe	84
PID 2892 wrote to memory of 2764	2892	DllCommonsvc.exe	124
PID 2892 wrote to memory of 2764	2892	DllCommonsvc.exe	124
PID 2892 wrote to memory of 3232	2892	DllCommonsvc.exe	126
PID 2892 wrote to memory of 3232	2892	DllCommonsvc.exe	126
PID 2892 wrote to memory of 2644	2892	DllCommonsvc.exe	125
PID 2892 wrote to memory of 2644	2892	DllCommonsvc.exe	125
PID 2892 wrote to memory of 4712	2892	DllCommonsvc.exe	128
PID 2892 wrote to memory of 4712	2892	DllCommonsvc.exe	128
PID 2892 wrote to memory of 1328	2892	DllCommonsvc.exe	130
PID 2892 wrote to memory of 1328	2892	DllCommonsvc.exe	130
PID 2892 wrote to memory of 980	2892	DllCommonsvc.exe	131
PID 2892 wrote to memory of 980	2892	DllCommonsvc.exe	131
PID 2892 wrote to memory of 1124	2892	DllCommonsvc.exe	133
PID 2892 wrote to memory of 1124	2892	DllCommonsvc.exe	133
PID 2892 wrote to memory of 4304	2892	DllCommonsvc.exe	135
PID 2892 wrote to memory of 4304	2892	DllCommonsvc.exe	135
PID 2892 wrote to memory of 4680	2892	DllCommonsvc.exe	140
PID 2892 wrote to memory of 4680	2892	DllCommonsvc.exe	140
PID 2892 wrote to memory of 4492	2892	DllCommonsvc.exe	141
PID 2892 wrote to memory of 4492	2892	DllCommonsvc.exe	141
PID 2892 wrote to memory of 736	2892	DllCommonsvc.exe	143
PID 2892 wrote to memory of 736	2892	DllCommonsvc.exe	143
PID 2892 wrote to memory of 948	2892	DllCommonsvc.exe	145
PID 2892 wrote to memory of 948	2892	DllCommonsvc.exe	145
PID 2892 wrote to memory of 2516	2892	DllCommonsvc.exe	151
PID 2892 wrote to memory of 2516	2892	DllCommonsvc.exe	151
PID 2892 wrote to memory of 2600	2892	DllCommonsvc.exe	150
PID 2892 wrote to memory of 2600	2892	DllCommonsvc.exe	150
PID 2892 wrote to memory of 2268	2892	DllCommonsvc.exe	152
PID 2892 wrote to memory of 2268	2892	DllCommonsvc.exe	152
PID 2268 wrote to memory of 388	2268	cmd.exe	154
PID 2268 wrote to memory of 388	2268	cmd.exe	154
PID 2268 wrote to memory of 4800	2268	cmd.exe	155
PID 2268 wrote to memory of 4800	2268	cmd.exe	155
PID 4800 wrote to memory of 4572	4800	StartMenuExperienceHost.exe	161
PID 4800 wrote to memory of 4572	4800	StartMenuExperienceHost.exe	161
PID 4572 wrote to memory of 2336	4572	cmd.exe	160
PID 4572 wrote to memory of 2336	4572	cmd.exe	160
PID 4572 wrote to memory of 3272	4572	cmd.exe	163
PID 4572 wrote to memory of 3272	4572	cmd.exe	163
PID 3272 wrote to memory of 1616	3272	StartMenuExperienceHost.exe	166
PID 3272 wrote to memory of 1616	3272	StartMenuExperienceHost.exe	166
PID 1616 wrote to memory of 4664	1616	cmd.exe	165
PID 1616 wrote to memory of 4664	1616	cmd.exe	165
PID 1616 wrote to memory of 3464	1616	cmd.exe	169
PID 1616 wrote to memory of 3464	1616	cmd.exe	169
PID 3464 wrote to memory of 3888	3464	StartMenuExperienceHost.exe	172
PID 3464 wrote to memory of 3888	3464	StartMenuExperienceHost.exe	172
PID 3888 wrote to memory of 4272	3888	cmd.exe	171
PID 3888 wrote to memory of 4272	3888	cmd.exe	171
PID 3888 wrote to memory of 1216	3888	cmd.exe	173
PID 3888 wrote to memory of 1216	3888	cmd.exe	173
PID 1216 wrote to memory of 1044	1216	StartMenuExperienceHost.exe	176
PID 1216 wrote to memory of 1044	1216	StartMenuExperienceHost.exe	176
PID 1044 wrote to memory of 4204	1044	cmd.exe	175
PID 1044 wrote to memory of 4204	1044	cmd.exe	175

C:\Users\Admin\AppData\Local\Temp\c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe
"C:\Users\Admin\AppData\Local\Temp\c8f9abb59a63b4b3a2d815dba93b56dca82008bbd8aa2d6b6c814bdab9c53238.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\winlogon.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\SearchApp.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\WmiPrvSE.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QfKFARzT3K.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:388
      - C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sWmtPUST1G.bat"
        15⤵
        
        PID:2256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:632
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat"
        17⤵
        
        PID:4120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1252
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rn5V8mQYRH.bat"
        19⤵
        
        PID:4256
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:644
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
        21⤵
        
        PID:748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1212
        
        C:\Windows\ShellExperiences\StartMenuExperienceHost.exe
        
        "C:\Windows\ShellExperiences\StartMenuExperienceHost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\PrintHood\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\PrintHood\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\fr-FR\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\fr-FR\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:2336

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4664

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4272

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22fbec4acba323d04079a263526cef3c

SHA1
eb8dd0042c6a3f20087a7d2391eaf48121f98740

SHA256
020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

SHA512
fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bf4015b074a6f408647188368cbe25f4

SHA1
a765f181884d7a02ddeab628fe609618692a36e6

SHA256
cee8320faacd6e6e833cb29ee5c2f6d273d0661e2bde852dc25efc4fad5f109a

SHA512
cec96f77452fb6dc3217af488b54d3850794780d10528c010aebb35895e434208ecff91f73a19b1c24a83efeb3d4d6a2100162b25ca6f23d12d118323390890c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f2ac548546c98820d47a99c7a7445f73

SHA1
affc0da28d6d866b1f0b64b75e544c6bc9a51aa7

SHA256
26b636f07ad44e45ffe5c4a5c45ac5e8ef1dffeafdffbecd447ad151ccf416ad

SHA512
93a46923f278fd308385443ffb1f69eb7d1ba3d0a5ab16a9c3cdce64f779f282f4e77eda7edd6a37c5fd55350f53fb4a3e527c2534309f6afcdf88377f1112cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f2ac548546c98820d47a99c7a7445f73

SHA1
affc0da28d6d866b1f0b64b75e544c6bc9a51aa7

SHA256
26b636f07ad44e45ffe5c4a5c45ac5e8ef1dffeafdffbecd447ad151ccf416ad

SHA512
93a46923f278fd308385443ffb1f69eb7d1ba3d0a5ab16a9c3cdce64f779f282f4e77eda7edd6a37c5fd55350f53fb4a3e527c2534309f6afcdf88377f1112cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9301fb10a9394288e8324feb7da20e8d

SHA1
13cf5e60e24b5ee2c70badf42a0c0a8a1af4d3d0

SHA256
1687eeb30b85104251b199766ec1f00574c3ecd46a35578c2d7ce6db95ea28ec

SHA512
9fb789ff290c48028e0bd3ddc6fbc5bc1e34d37a967123f3f565ba639cc820901885ab4316e64dbf72515fa254f12ffc16273560aa681b7a28f564301181ab66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9301fb10a9394288e8324feb7da20e8d

SHA1
13cf5e60e24b5ee2c70badf42a0c0a8a1af4d3d0

SHA256
1687eeb30b85104251b199766ec1f00574c3ecd46a35578c2d7ce6db95ea28ec

SHA512
9fb789ff290c48028e0bd3ddc6fbc5bc1e34d37a967123f3f565ba639cc820901885ab4316e64dbf72515fa254f12ffc16273560aa681b7a28f564301181ab66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f5e4c77196d7cd5c200f4ef46170af44

SHA1
2bc7453be0328f7fea15eea2dbd3d400e21e5036

SHA256
00bb0b59892b7b4b602a79dfa4bfa89eccee33d09e80138d2d28976900846e22

SHA512
4755c87257057984abf842f4127116949f7ee2eb558cf5974c447d0ebcf047f20e1b88252965697490f4eaf12d1d3408041f24f6deb52ff2928f87b0988323f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f5e4c77196d7cd5c200f4ef46170af44

SHA1
2bc7453be0328f7fea15eea2dbd3d400e21e5036

SHA256
00bb0b59892b7b4b602a79dfa4bfa89eccee33d09e80138d2d28976900846e22

SHA512
4755c87257057984abf842f4127116949f7ee2eb558cf5974c447d0ebcf047f20e1b88252965697490f4eaf12d1d3408041f24f6deb52ff2928f87b0988323f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat

Filesize
220B

MD5
fa969cdbeab78e6c6791dbf4f5f47d48

SHA1
113d1bc59010fabf84b2b3d7e6c00251fd632ee3

SHA256
46c6ef9a99a26d939f2a110ef93c29895edc624527047574238123907a9416f8

SHA512
f5027861028205afebbb237e777818682ab153f90ba6576ba25dadeec8cfc16e244da99a7af126ebd6067d47c5c05793a671a7fd0d4e38ec89ec830a105a03ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\AQ0EpYUV7r.bat

Filesize
220B

MD5
7b945fe016da29a27b19fb16548b637c

SHA1
55559c215bb9f2ecd86f3d47cf284a6f2e697c70

SHA256
f9a16934f0c8169fdfda5ed3c659e1c54d472277e4b29453aa2525b114420cb4

SHA512
90a3911c7d560fcdd1d2af1c3833c165e8edcc900b03bb4dee02dc0f5f7539fee3fad6673bd273a69edda91a5e8bb069c68cd727d5d486209eb95f8bc17c8b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\QfKFARzT3K.bat

Filesize
220B

MD5
360765def44fea7c237bd374abee64d1

SHA1
aa13328ac8a79e85e14724d9a93212d414bf4c3b

SHA256
5d4aaff1c6ce23b96a14b26322a479af306522b3206d18a912f8100d8301bf58

SHA512
f46562aa763a869429ee1cad5a5aa1d6b3227b5f570590c4eecd6aad5b20058a00588865d4313ddc664460ef9ccb5e7bf0ab861080b0cdd2c6a8d9531aa334f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rn5V8mQYRH.bat

Filesize
220B

MD5
4525b1f38377fd2324f7d832bcbccd24

SHA1
a8af115046974713fe6b4b12f2a1e4b545257edb

SHA256
21aa2ad25a70dc951b0244677da736f41a70dde5abbb557efeae0aa16a71e848

SHA512
29e6aac1e088e11404419116dc7b6dd9d273c18f2fad8c30937b47468ff1a283d5e8c7096aaa57c58cc7cc856277ee22473f727abc6664283bdc1be158d373ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y29a6RA8xz.bat

Filesize
220B

MD5
b75291df99567c9f07ffec3d419de0b4

SHA1
261b6fb5aa329f430387b93a25da184ef469ed83

SHA256
7af62d5a6105e744602c8da0501888514001640f8254a91bff7201e17ac132b5

SHA512
74dfa567c2077ea4ae2c2a73685f245b16daa77cd576db00c2d800bd7cd92a8deb9fded5528fc6403a880e0dd9ec32a82dd2fb7ccb8af1c0ddc4cc46c36f4a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat

Filesize
220B

MD5
231c9265d5b6e8d8a302d962b37f710b

SHA1
43cda7b5183ab3384c30bbb8d752e84e6fa85e32

SHA256
b81d535dcb16f7afad3e10e4e5985a812959795d355741c6672715978dcbacc9

SHA512
a247d560448cfbbc1b20e73539bc865fbba0b61d356dce4d695016ac3e427a0328c1a48a8128603e68e287692915f5e113194b35f4e5780368a1fa82fec0cd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat

Filesize
220B

MD5
231c9265d5b6e8d8a302d962b37f710b

SHA1
43cda7b5183ab3384c30bbb8d752e84e6fa85e32

SHA256
b81d535dcb16f7afad3e10e4e5985a812959795d355741c6672715978dcbacc9

SHA512
a247d560448cfbbc1b20e73539bc865fbba0b61d356dce4d695016ac3e427a0328c1a48a8128603e68e287692915f5e113194b35f4e5780368a1fa82fec0cd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat

Filesize
220B

MD5
1451f7b32982ff0f9ef4bd0ab09b4fde

SHA1
262f3bd12f32cbb6c03da4a7f5562463dfd9628f

SHA256
5c8b93b66883268a98ba2a9aa5f9dd9b731a3588db488520bd9397e04a4e66af

SHA512
eecc026011e1b89f9497646f93a20cc95f365b18f37024114b364188f268eb5c6f82a1d10d3c0cb51e1f614fcbe8d66aa8b265854c64ec3577d7b021a3022913

Download Submit
C:\Users\Admin\AppData\Local\Temp\sWmtPUST1G.bat

Filesize
220B

MD5
3d5cb2bebdaeeffec9da99ea99e7e5b1

SHA1
ff0a666b583f0ffd6120186db89708738be05e49

SHA256
21fb04d122b8380c239840f0af09b53e2f46b167cb6e9a8f94a871ba59d008bc

SHA512
3e8198c8c6ba836fc5ac2d3f793d848323d03201512e113a21f17d14122555fd9dee287e9ca34277c4d5ecdfa18dabe75452ef413101607709d7e722579ec653

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Windows\ShellExperiences\StartMenuExperienceHost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/736-168-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/736-200-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/948-169-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/948-178-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/980-189-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/980-160-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/1124-181-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/1124-162-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-227-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-231-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-188-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-159-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/1516-248-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1516-252-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/2516-167-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2600-199-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2600-174-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2644-158-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2644-177-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-165-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2764-191-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-164-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/2892-139-0x00000000007F0000-0x0000000000900000-memory.dmp

Filesize
1.1MB

Download
memory/2892-140-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/3232-153-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/3232-155-0x000001AA090A0000-0x000001AA090C2000-memory.dmp

Filesize
136KB

Download
memory/3232-185-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/3272-217-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/3272-213-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/3464-224-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3464-220-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3812-234-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3812-238-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/4304-163-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4304-192-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4312-259-0x00007FFD89530000-0x00007FFD89FF1000-memory.dmp

Filesize
10.8MB

Download
memory/4312-255-0x00007FFD89530000-0x00007FFD89FF1000-memory.dmp

Filesize
10.8MB

Download
memory/4492-196-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4492-173-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4492-245-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/4492-241-0x00007FFD89410000-0x00007FFD89ED1000-memory.dmp

Filesize
10.8MB

Download
memory/4680-194-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4680-171-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4712-184-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4712-157-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4800-204-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4800-205-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4800-209-0x00007FFD89720000-0x00007FFD8A1E1000-memory.dmp

Filesize
10.8MB

Download