dcrat | 5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe
Size

1.3MB
MD5

79031c149175b294114a74a0bff4041f
SHA1

a6b7c9f883a2ef4b9c97d5457497db79a2555d62
SHA256

5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb
SHA512

988b08d3dbf7617373a2d504fbdcaa46b8026261d77f8fa872755385e71210cb620b96d1f5729882aaff906ec63540ca198416d710992b63742ff5969481e6c8
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1376	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	1376	schtasks.exe	18

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000022da5-137.dat	dcrat
behavioral1/files/0x0002000000022da5-138.dat	dcrat
behavioral1/memory/1000-139-0x0000000000260000-0x0000000000370000-memory.dmp	dcrat
behavioral1/files/0x0001000000022de7-159.dat	dcrat
behavioral1/files/0x0001000000022de7-158.dat	dcrat
behavioral1/files/0x0001000000022de7-208.dat	dcrat
behavioral1/files/0x0001000000022de7-216.dat	dcrat
behavioral1/files/0x0001000000022de7-223.dat	dcrat
behavioral1/files/0x0001000000022de7-230.dat	dcrat
behavioral1/files/0x0001000000022de7-237.dat	dcrat
behavioral1/files/0x0001000000022de7-244.dat	dcrat
behavioral1/files/0x0001000000022de7-251.dat	dcrat
behavioral1/files/0x0001000000022de7-258.dat	dcrat
behavioral1/files/0x0001000000022de7-265.dat	dcrat

Executes dropped EXE 11 IoCs

pid	Process
1000	DllCommonsvc.exe
2584	spoolsv.exe
4684	spoolsv.exe
4044	spoolsv.exe
1144	spoolsv.exe
308	spoolsv.exe
4288	spoolsv.exe
3340	spoolsv.exe
748	spoolsv.exe
628	spoolsv.exe
3932	spoolsv.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	spoolsv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Common Files\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\69ddcba757bf72	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DiagTrack\Scenarios\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\DiagTrack\Scenarios\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3732	schtasks.exe
3748	schtasks.exe
3724	schtasks.exe
4540	schtasks.exe
2852	schtasks.exe
1428	schtasks.exe
4824	schtasks.exe
2584	schtasks.exe
1260	schtasks.exe
216	schtasks.exe
2004	schtasks.exe
3988	schtasks.exe
344	schtasks.exe
1700	schtasks.exe
2896	schtasks.exe
3492	schtasks.exe
4536	schtasks.exe
3420	schtasks.exe
5096	schtasks.exe
3768	schtasks.exe
4020	schtasks.exe
544	schtasks.exe
3544	schtasks.exe
5068	schtasks.exe
5084	schtasks.exe
828	schtasks.exe
3508	schtasks.exe
3784	schtasks.exe
2436	schtasks.exe
2492	schtasks.exe
3892	schtasks.exe
3100	schtasks.exe
2104	schtasks.exe
4532	schtasks.exe
2112	schtasks.exe
772	schtasks.exe
4624	schtasks.exe
1520	schtasks.exe
2340	schtasks.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
1000	DllCommonsvc.exe
2360	powershell.exe
2360	powershell.exe
2144	powershell.exe
2144	powershell.exe
992	powershell.exe
992	powershell.exe
4188	powershell.exe
4188	powershell.exe
2476	powershell.exe
2476	powershell.exe
4084	powershell.exe
4084	powershell.exe
1820	powershell.exe
1820	powershell.exe
1388	powershell.exe
1388	powershell.exe
4460	powershell.exe
4460	powershell.exe
2796	powershell.exe
2796	powershell.exe
2616	powershell.exe
2616	powershell.exe
2604	powershell.exe
2604	powershell.exe
1464	powershell.exe
1464	powershell.exe
2928	powershell.exe
2928	powershell.exe
2584	spoolsv.exe
2584	spoolsv.exe
4188	powershell.exe
4188	powershell.exe
2360	powershell.exe
2360	powershell.exe
992	powershell.exe
992	powershell.exe
2144	powershell.exe
2144	powershell.exe
2476	powershell.exe
2476	powershell.exe
1820	powershell.exe
1820	powershell.exe
4084	powershell.exe
4084	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	DllCommonsvc.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2584	spoolsv.exe
Token: SeDebugPrivilege	4684	spoolsv.exe
Token: SeDebugPrivilege	4044	spoolsv.exe
Token: SeDebugPrivilege	1144	spoolsv.exe
Token: SeDebugPrivilege	308	spoolsv.exe
Token: SeDebugPrivilege	4288	spoolsv.exe
Token: SeDebugPrivilege	3340	spoolsv.exe
Token: SeDebugPrivilege	748	spoolsv.exe
Token: SeDebugPrivilege	628	spoolsv.exe
Token: SeDebugPrivilege	3932	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4816	1616	5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe	80
PID 1616 wrote to memory of 4816	1616	5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe	80
PID 1616 wrote to memory of 4816	1616	5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe	80
PID 4816 wrote to memory of 740	4816	WScript.exe	84
PID 4816 wrote to memory of 740	4816	WScript.exe	84
PID 4816 wrote to memory of 740	4816	WScript.exe	84
PID 740 wrote to memory of 1000	740	cmd.exe	86
PID 740 wrote to memory of 1000	740	cmd.exe	86
PID 1000 wrote to memory of 2360	1000	DllCommonsvc.exe	127
PID 1000 wrote to memory of 2360	1000	DllCommonsvc.exe	127
PID 1000 wrote to memory of 2144	1000	DllCommonsvc.exe	128
PID 1000 wrote to memory of 2144	1000	DllCommonsvc.exe	128
PID 1000 wrote to memory of 4188	1000	DllCommonsvc.exe	129
PID 1000 wrote to memory of 4188	1000	DllCommonsvc.exe	129
PID 1000 wrote to memory of 2476	1000	DllCommonsvc.exe	131
PID 1000 wrote to memory of 2476	1000	DllCommonsvc.exe	131
PID 1000 wrote to memory of 992	1000	DllCommonsvc.exe	133
PID 1000 wrote to memory of 992	1000	DllCommonsvc.exe	133
PID 1000 wrote to memory of 1820	1000	DllCommonsvc.exe	153
PID 1000 wrote to memory of 1820	1000	DllCommonsvc.exe	153
PID 1000 wrote to memory of 4084	1000	DllCommonsvc.exe	135
PID 1000 wrote to memory of 4084	1000	DllCommonsvc.exe	135
PID 1000 wrote to memory of 1388	1000	DllCommonsvc.exe	136
PID 1000 wrote to memory of 1388	1000	DllCommonsvc.exe	136
PID 1000 wrote to memory of 4460	1000	DllCommonsvc.exe	137
PID 1000 wrote to memory of 4460	1000	DllCommonsvc.exe	137
PID 1000 wrote to memory of 2796	1000	DllCommonsvc.exe	139
PID 1000 wrote to memory of 2796	1000	DllCommonsvc.exe	139
PID 1000 wrote to memory of 2616	1000	DllCommonsvc.exe	141
PID 1000 wrote to memory of 2616	1000	DllCommonsvc.exe	141
PID 1000 wrote to memory of 2604	1000	DllCommonsvc.exe	143
PID 1000 wrote to memory of 2604	1000	DllCommonsvc.exe	143
PID 1000 wrote to memory of 1464	1000	DllCommonsvc.exe	144
PID 1000 wrote to memory of 1464	1000	DllCommonsvc.exe	144
PID 1000 wrote to memory of 2928	1000	DllCommonsvc.exe	147
PID 1000 wrote to memory of 2928	1000	DllCommonsvc.exe	147
PID 1000 wrote to memory of 2584	1000	DllCommonsvc.exe	155
PID 1000 wrote to memory of 2584	1000	DllCommonsvc.exe	155
PID 2584 wrote to memory of 1700	2584	spoolsv.exe	158
PID 2584 wrote to memory of 1700	2584	spoolsv.exe	158
PID 1700 wrote to memory of 4736	1700	cmd.exe	159
PID 1700 wrote to memory of 4736	1700	cmd.exe	159
PID 1700 wrote to memory of 4684	1700	cmd.exe	162
PID 1700 wrote to memory of 4684	1700	cmd.exe	162
PID 4684 wrote to memory of 3328	4684	spoolsv.exe	163
PID 4684 wrote to memory of 3328	4684	spoolsv.exe	163
PID 3328 wrote to memory of 4468	3328	cmd.exe	165
PID 3328 wrote to memory of 4468	3328	cmd.exe	165
PID 3328 wrote to memory of 4044	3328	cmd.exe	166
PID 3328 wrote to memory of 4044	3328	cmd.exe	166
PID 4044 wrote to memory of 1640	4044	spoolsv.exe	167
PID 4044 wrote to memory of 1640	4044	spoolsv.exe	167
PID 1640 wrote to memory of 2120	1640	cmd.exe	169
PID 1640 wrote to memory of 2120	1640	cmd.exe	169
PID 1640 wrote to memory of 1144	1640	cmd.exe	170
PID 1640 wrote to memory of 1144	1640	cmd.exe	170
PID 1144 wrote to memory of 3344	1144	spoolsv.exe	171
PID 1144 wrote to memory of 3344	1144	spoolsv.exe	171
PID 3344 wrote to memory of 1604	3344	cmd.exe	173
PID 3344 wrote to memory of 1604	3344	cmd.exe	173
PID 3344 wrote to memory of 308	3344	cmd.exe	174
PID 3344 wrote to memory of 308	3344	cmd.exe	174
PID 308 wrote to memory of 1788	308	spoolsv.exe	175
PID 308 wrote to memory of 1788	308	spoolsv.exe	175

C:\Users\Admin\AppData\Local\Temp\5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe
"C:\Users\Admin\AppData\Local\Temp\5a656fad6aafac41ca8229c3cb8a860f71ec43e7a1261e40f9b9fdcc331780cb.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dwm.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\upfc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DiagTrack\Scenarios\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SppExtComObj.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
    - - C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PoOVO2yVWN.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4736
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4468
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2120
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        11⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pgCyA6Uc1O.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1604
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        13⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat"
        14⤵
        
        PID:1788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3356
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        15⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjauxUKpXQ.bat"
        16⤵
        
        PID:2024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3388
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        17⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9EGxcg3vT.bat"
        18⤵
        
        PID:2344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1476
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        19⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HAQQp9H1T4.bat"
        20⤵
        
        PID:2896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:760
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        21⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat"
        22⤵
        
        PID:2964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4788
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        23⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YyUd3mmyLr.bat"
        24⤵
        
        PID:3024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\odt\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Public\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Users\Default\PrintHood\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Users\Default\PrintHood\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Default\AppData\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\AppData\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default\AppData\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\DiagTrack\Scenarios\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\DiagTrack\Scenarios\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8ce785f8ccc6d202d56fefc59764945

SHA1
ca032c62ddc5e0f26d84eff9895eb87f14e15960

SHA256
d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

SHA512
66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
101c3b86ef1c02c62b7d862c2a47363b

SHA1
3c5e8d309610e5ba41b6b9788bfb826e45864b46

SHA256
9174446e5bf6366c610c790d5176cf11a65574345cc15ca7ded7247daf4d233c

SHA512
d199aa9fbfefea6a27e1c6414b17c1e03c39840047f03c71788f83d37f30651df49dc865c0c38214bab7923bcd2e57e064817b9f1453818c2e7a29d3686d2d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\5Ad8adCyX4.bat

Filesize
183B

MD5
ea57a2101eacbb217c42c7604b1cd39c

SHA1
a964b0281b6536c3760588e31a85c808e832a2ff

SHA256
dde0949f5118193b283d6b8c4dddd4b8255c67311d6d52d3449b5e2d4ede8ca3

SHA512
e89164f84293030d49bcbc6ff0ce3e4e6875e54f63143d0cd3f81954ae1b1ff235d62f64b256c30aa4d85756d4472f18a00af8d67eb58662d57705b0576731a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9EGxcg3vT.bat

Filesize
183B

MD5
caba7b7fff04dbd90bf321afe76cca91

SHA1
ae6482ee2a702301a6f3dd46748d5051be393861

SHA256
85a437bba892d264d060aebb0e41da4110b8d108a4f3209dd3d0bc1c901d9866

SHA512
c216236db11eed47f2d17f35152edf4bea552460d062dcc956315a74382299b3d50ab42e9def3e33d490f065de0cbf0a1fbb55f837f5931277d129ade76da421

Download Submit
C:\Users\Admin\AppData\Local\Temp\HAQQp9H1T4.bat

Filesize
183B

MD5
f07b0375728ce1160b31be9966c73fde

SHA1
0c1502f5fc749f43ef5ac9321ecc1bc13da7d22a

SHA256
5768f2297324a4790f7386d1563be3141046605d7d896becb50ded0c7e2b38ca

SHA512
041c16e5eab717c77985219af1d5af1ec22521905d185a1af37fa09bb1c42490e56c534b47a4c82a1e8d2c7b35726972e1079b9b3222982b3d3b130d8763a13e

Download Submit
C:\Users\Admin\AppData\Local\Temp\PoOVO2yVWN.bat

Filesize
183B

MD5
ee746ae0c27a890f24590cd94c9125f7

SHA1
c8539c70b6401946d5c432e76bfc1026c3bc73fa

SHA256
4203ea5046159e9987e84694d0d70b03abceb100f062394e50423cbce6272e3a

SHA512
1ee6659dccbce4b6e2eca2b4f536318b565a5c96f586d91a9101f321a926faebed0f95e1b545279db737b22030e0e758178b592cef031052174f4534d075ec8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\YyUd3mmyLr.bat

Filesize
183B

MD5
741940bd05ef2067f380b9a3ef8c1c88

SHA1
1a0b35e06cc6b8a9a9b1e6f6ec591ae326c595db

SHA256
6880842442986e070b1aced627dd79dd1b1b188767994da7314fb17976a49d9f

SHA512
7ddf6f85d9fb7140f03c7135ec71ff79f0caeba84485f96cca4e6e9783b5dbad1ff496ac5cfb17d5fdb85e5c1299660a87b26e1566c4da3d654bcbc8335ac12f

Download Submit
C:\Users\Admin\AppData\Local\Temp\blOcFVMglb.bat

Filesize
183B

MD5
e9e7c098dd0ee1de4aaedfd72de2d7e3

SHA1
d1cafe734b548181bf94ade88ce45f3ef7ee7482

SHA256
51f598a688ca5cf83706f96af4d5f2a93f4182cf45c35c96dd1ca9235c067440

SHA512
a852453d67abbe79863322a0a1e2604198e42c609f1293be4001004486e802d9d1df88ee4fb3ebcf16bd1df4e9eece9a39e9f547b03f215e0eee18c69bc365e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat

Filesize
183B

MD5
d3929c01eca12d24aa356f02ef68cc6e

SHA1
fd936ede1291ca58c32747c466ad6aa9c9628137

SHA256
54cbf5142f7e2d472d17302b50e2d0f18aee398d48e72f36d58222c1f6e297e0

SHA512
f829aaa75ba68d3029bf4cf265cb144b44f11c985e5a5e5dc21dd2cff84247410e1bd5d76496d8eb7a23f1d0f45fdfc945ffa343ba5e5adc2420e63aab68b5ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgCyA6Uc1O.bat

Filesize
183B

MD5
198edcfb28ff944559e747ee7e2fecf5

SHA1
5316b1ec664c644738cff768fbd58fb0bef912ab

SHA256
3547d518fe225544b3e7c1d3ab3c1e5b1f05d8827ea08854e415dbfe643a04e4

SHA512
58770c14abad9ce1bde9e9114f6ed3a78595e0f6cc6b8d51fef04ef50dbdfa220595f5f4a379ba3a33e91cebf969912c8e79f1d849c64ad63b3bffbb0aac9556

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjauxUKpXQ.bat

Filesize
183B

MD5
25a5be4ce94e5feb43d9895ecab03bbd

SHA1
e6c3ecfef8be92dbffff8c96f7b771025338b6bd

SHA256
03c1b8010d0e925223be82541485b3b772ab1778171fab42dd28f34dfe09c5eb

SHA512
ec7dede721819e3783fb44a2c2191e0d019491d6146c6a87d7f34bcf92fab2a35d3b77e7fa8b991f8538c26a168ad2192f5b56dd8cff103b8914210f8c0a366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tYG4XGbOex.bat

Filesize
183B

MD5
f6b75d7ebfa80bd72de38adf015a8b2c

SHA1
0cde9e0162801944ec01af3b1965d410d2cd941d

SHA256
5170f13523443e2684deebc3e17f2967b73d7e87eb8562ae08843c40ddfbaa57

SHA512
05385639e5fd9ed441dca2e26ca6008f7180de6dee6c91858a53df481acec00ee75fd92349fd827d4e818522e119a807e815436a6ccad4ece481ee6b8523ee96

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\spoolsv.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/308-234-0x00007FFDB6070000-0x00007FFDB6B31000-memory.dmp

Filesize
10.8MB

Download
memory/308-231-0x00007FFDB6070000-0x00007FFDB6B31000-memory.dmp

Filesize
10.8MB

Download
memory/628-259-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/628-263-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/748-256-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/748-252-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/992-181-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/992-164-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1000-139-0x0000000000260000-0x0000000000370000-memory.dmp

Filesize
1.1MB

Download
memory/1000-140-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1000-162-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1144-228-0x00007FFDB6070000-0x00007FFDB6B31000-memory.dmp

Filesize
10.8MB

Download
memory/1144-224-0x00007FFDB6070000-0x00007FFDB6B31000-memory.dmp

Filesize
10.8MB

Download
memory/1388-167-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1388-192-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1464-194-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1464-173-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1820-165-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/1820-190-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2144-183-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2144-160-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2360-179-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2360-156-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2360-154-0x0000020BFEE10000-0x0000020BFEE32000-memory.dmp

Filesize
136KB

Download
memory/2476-185-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2476-163-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2584-172-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2584-191-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2604-171-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2604-206-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2616-170-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2616-201-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2796-169-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2796-196-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2928-174-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2928-200-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/3340-249-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/3340-245-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-266-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/3932-270-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/4044-217-0x00007FFDB6070000-0x00007FFDB6B31000-memory.dmp

Filesize
10.8MB

Download
memory/4044-221-0x00007FFDB6070000-0x00007FFDB6B31000-memory.dmp

Filesize
10.8MB

Download
memory/4084-166-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4084-188-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-161-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4188-177-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4288-241-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/4288-238-0x00007FFDB6120000-0x00007FFDB6BE1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-168-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4460-202-0x00007FFDB6520000-0x00007FFDB6FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4684-214-0x00007FFDB6470000-0x00007FFDB6F31000-memory.dmp

Filesize
10.8MB

Download
memory/4684-210-0x00007FFDB6470000-0x00007FFDB6F31000-memory.dmp

Filesize
10.8MB

Download