dcrat | dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7

Analysis

max time kernel
146s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-11-2022 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe
Size

1.3MB
MD5

fcc4c86a01e8ed989f76bd2f0d03d79c
SHA1

23a92c0a1afe31a0f21a8d6a4df631e4cb275dab
SHA256

dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7
SHA512

65c03738d8c5c5a64132ef1d3e4fae1b73b8482a468066a21f0ef1d75dcebf57baa3e909614b79bb3a1b60d01913cc0468fe1cc83e5e4f517a419f62f2b023ad
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	792	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	3008	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	3008	schtasks.exe	70

DCRat payload 15 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac18-282.dat	dcrat
behavioral1/files/0x000800000001ac18-283.dat	dcrat
behavioral1/memory/3204-284-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac35-326.dat	dcrat
behavioral1/files/0x000700000001ac35-325.dat	dcrat
behavioral1/files/0x000700000001ac35-649.dat	dcrat
behavioral1/files/0x000700000001ac35-655.dat	dcrat
behavioral1/files/0x000700000001ac35-661.dat	dcrat
behavioral1/files/0x000700000001ac35-666.dat	dcrat
behavioral1/files/0x000700000001ac35-672.dat	dcrat
behavioral1/files/0x000700000001ac35-677.dat	dcrat
behavioral1/files/0x000700000001ac35-683.dat	dcrat
behavioral1/files/0x000700000001ac35-689.dat	dcrat
behavioral1/files/0x000700000001ac35-694.dat	dcrat
behavioral1/files/0x000700000001ac35-699.dat	dcrat

Executes dropped EXE 12 IoCs

pid	Process
3204	DllCommonsvc.exe
4028	taskhostw.exe
584	taskhostw.exe
5116	taskhostw.exe
892	taskhostw.exe
4628	taskhostw.exe
3468	taskhostw.exe
4956	taskhostw.exe
2588	taskhostw.exe
1052	taskhostw.exe
4056	taskhostw.exe
2124	taskhostw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\en-US\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\taskhostw.exe	DllCommonsvc.exe
File created	C:\Program Files\MSBuild\Microsoft\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\lsass.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bcastdvr\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\bcastdvr\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3720	schtasks.exe
5020	schtasks.exe
584	schtasks.exe
4972	schtasks.exe
5008	schtasks.exe
1176	schtasks.exe
2648	schtasks.exe
4940	schtasks.exe
4992	schtasks.exe
4892	schtasks.exe
640	schtasks.exe
3152	schtasks.exe
5108	schtasks.exe
4968	schtasks.exe
1564	schtasks.exe
2644	schtasks.exe
2040	schtasks.exe
656	schtasks.exe
740	schtasks.exe
4100	schtasks.exe
1028	schtasks.exe
1600	schtasks.exe
64	schtasks.exe
3792	schtasks.exe
4668	schtasks.exe
792	schtasks.exe
4896	schtasks.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	taskhostw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
3204	DllCommonsvc.exe
2656	powershell.exe
1832	powershell.exe
3336	powershell.exe
1216	powershell.exe
1216	powershell.exe
1556	powershell.exe
1556	powershell.exe
3344	powershell.exe
3356	powershell.exe
2136	powershell.exe
2136	powershell.exe
192	powershell.exe
4028	taskhostw.exe
4028	taskhostw.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
1216	powershell.exe
1216	powershell.exe
1556	powershell.exe
1556	powershell.exe
1832	powershell.exe
2656	powershell.exe
3336	powershell.exe
3344	powershell.exe
3344	powershell.exe
3356	powershell.exe
3356	powershell.exe
2136	powershell.exe
2136	powershell.exe
192	powershell.exe
192	powershell.exe
2400	powershell.exe
1832	powershell.exe
1832	powershell.exe
2656	powershell.exe
2656	powershell.exe
3344	powershell.exe
3356	powershell.exe
3336	powershell.exe
3336	powershell.exe
192	powershell.exe
584	taskhostw.exe
5116	taskhostw.exe
892	taskhostw.exe
4628	taskhostw.exe
3468	taskhostw.exe
4956	taskhostw.exe
2588	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	DllCommonsvc.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	4028	taskhostw.exe
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	192	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeIncreaseQuotaPrivilege	1556	powershell.exe
Token: SeSecurityPrivilege	1556	powershell.exe
Token: SeTakeOwnershipPrivilege	1556	powershell.exe
Token: SeLoadDriverPrivilege	1556	powershell.exe
Token: SeSystemProfilePrivilege	1556	powershell.exe
Token: SeSystemtimePrivilege	1556	powershell.exe
Token: SeProfSingleProcessPrivilege	1556	powershell.exe
Token: SeIncBasePriorityPrivilege	1556	powershell.exe
Token: SeCreatePagefilePrivilege	1556	powershell.exe
Token: SeBackupPrivilege	1556	powershell.exe
Token: SeRestorePrivilege	1556	powershell.exe
Token: SeShutdownPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeSystemEnvironmentPrivilege	1556	powershell.exe
Token: SeRemoteShutdownPrivilege	1556	powershell.exe
Token: SeUndockPrivilege	1556	powershell.exe
Token: SeManageVolumePrivilege	1556	powershell.exe
Token: 33	1556	powershell.exe
Token: 34	1556	powershell.exe
Token: 35	1556	powershell.exe
Token: 36	1556	powershell.exe
Token: SeIncreaseQuotaPrivilege	1216	powershell.exe
Token: SeSecurityPrivilege	1216	powershell.exe
Token: SeTakeOwnershipPrivilege	1216	powershell.exe
Token: SeLoadDriverPrivilege	1216	powershell.exe
Token: SeSystemProfilePrivilege	1216	powershell.exe
Token: SeSystemtimePrivilege	1216	powershell.exe
Token: SeProfSingleProcessPrivilege	1216	powershell.exe
Token: SeIncBasePriorityPrivilege	1216	powershell.exe
Token: SeCreatePagefilePrivilege	1216	powershell.exe
Token: SeBackupPrivilege	1216	powershell.exe
Token: SeRestorePrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeSystemEnvironmentPrivilege	1216	powershell.exe
Token: SeRemoteShutdownPrivilege	1216	powershell.exe
Token: SeUndockPrivilege	1216	powershell.exe
Token: SeManageVolumePrivilege	1216	powershell.exe
Token: 33	1216	powershell.exe
Token: 34	1216	powershell.exe
Token: 35	1216	powershell.exe
Token: 36	1216	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4572	4324	dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe	66
PID 4324 wrote to memory of 4572	4324	dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe	66
PID 4324 wrote to memory of 4572	4324	dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe	66
PID 4572 wrote to memory of 5044	4572	WScript.exe	67
PID 4572 wrote to memory of 5044	4572	WScript.exe	67
PID 4572 wrote to memory of 5044	4572	WScript.exe	67
PID 5044 wrote to memory of 3204	5044	cmd.exe	69
PID 5044 wrote to memory of 3204	5044	cmd.exe	69
PID 3204 wrote to memory of 2656	3204	DllCommonsvc.exe	98
PID 3204 wrote to memory of 2656	3204	DllCommonsvc.exe	98
PID 3204 wrote to memory of 1832	3204	DllCommonsvc.exe	102
PID 3204 wrote to memory of 1832	3204	DllCommonsvc.exe	102
PID 3204 wrote to memory of 1556	3204	DllCommonsvc.exe	101
PID 3204 wrote to memory of 1556	3204	DllCommonsvc.exe	101
PID 3204 wrote to memory of 1216	3204	DllCommonsvc.exe	118
PID 3204 wrote to memory of 1216	3204	DllCommonsvc.exe	118
PID 3204 wrote to memory of 3356	3204	DllCommonsvc.exe	104
PID 3204 wrote to memory of 3356	3204	DllCommonsvc.exe	104
PID 3204 wrote to memory of 3344	3204	DllCommonsvc.exe	116
PID 3204 wrote to memory of 3344	3204	DllCommonsvc.exe	116
PID 3204 wrote to memory of 3336	3204	DllCommonsvc.exe	105
PID 3204 wrote to memory of 3336	3204	DllCommonsvc.exe	105
PID 3204 wrote to memory of 192	3204	DllCommonsvc.exe	106
PID 3204 wrote to memory of 192	3204	DllCommonsvc.exe	106
PID 3204 wrote to memory of 2136	3204	DllCommonsvc.exe	107
PID 3204 wrote to memory of 2136	3204	DllCommonsvc.exe	107
PID 3204 wrote to memory of 2400	3204	DllCommonsvc.exe	111
PID 3204 wrote to memory of 2400	3204	DllCommonsvc.exe	111
PID 3204 wrote to memory of 4028	3204	DllCommonsvc.exe	109
PID 3204 wrote to memory of 4028	3204	DllCommonsvc.exe	109
PID 4028 wrote to memory of 3308	4028	taskhostw.exe	119
PID 4028 wrote to memory of 3308	4028	taskhostw.exe	119
PID 3308 wrote to memory of 784	3308	cmd.exe	122
PID 3308 wrote to memory of 784	3308	cmd.exe	122
PID 3308 wrote to memory of 584	3308	cmd.exe	123
PID 3308 wrote to memory of 584	3308	cmd.exe	123
PID 584 wrote to memory of 588	584	taskhostw.exe	124
PID 584 wrote to memory of 588	584	taskhostw.exe	124
PID 588 wrote to memory of 3724	588	cmd.exe	126
PID 588 wrote to memory of 3724	588	cmd.exe	126
PID 588 wrote to memory of 5116	588	cmd.exe	127
PID 588 wrote to memory of 5116	588	cmd.exe	127
PID 5116 wrote to memory of 4716	5116	taskhostw.exe	128
PID 5116 wrote to memory of 4716	5116	taskhostw.exe	128
PID 4716 wrote to memory of 3288	4716	cmd.exe	130
PID 4716 wrote to memory of 3288	4716	cmd.exe	130
PID 4716 wrote to memory of 892	4716	cmd.exe	131
PID 4716 wrote to memory of 892	4716	cmd.exe	131
PID 892 wrote to memory of 3860	892	taskhostw.exe	132
PID 892 wrote to memory of 3860	892	taskhostw.exe	132
PID 3860 wrote to memory of 2020	3860	cmd.exe	134
PID 3860 wrote to memory of 2020	3860	cmd.exe	134
PID 3860 wrote to memory of 4628	3860	cmd.exe	135
PID 3860 wrote to memory of 4628	3860	cmd.exe	135
PID 4628 wrote to memory of 2900	4628	taskhostw.exe	136
PID 4628 wrote to memory of 2900	4628	taskhostw.exe	136
PID 2900 wrote to memory of 3352	2900	cmd.exe	138
PID 2900 wrote to memory of 3352	2900	cmd.exe	138
PID 2900 wrote to memory of 3468	2900	cmd.exe	139
PID 2900 wrote to memory of 3468	2900	cmd.exe	139
PID 3468 wrote to memory of 4564	3468	taskhostw.exe	140
PID 3468 wrote to memory of 4564	3468	taskhostw.exe	140
PID 4564 wrote to memory of 2204	4564	cmd.exe	142
PID 4564 wrote to memory of 2204	4564	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe
"C:\Users\Admin\AppData\Local\Temp\dec95ca726c861a2e4703ee7e6fa96b3e796e5d07f092fa703c8614263d64aa7.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\taskhostw.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1XclINWiF.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:784
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3724
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d8IMWcflW5.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3288
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SNnEytbzjv.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:2020
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3352
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2204
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat"
        18⤵
        
        PID:3856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4036
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PGGCz4Ehy5.bat"
        20⤵
        
        PID:3772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:3524
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat"
        22⤵
        
        PID:4064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4084
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
        24⤵
        
        PID:3796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3336
        
        C:\Program Files\MSBuild\Microsoft\taskhostw.exe
        
        "C:\Program Files\MSBuild\Microsoft\taskhostw.exe"
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b6uRiEqY03.bat"
        26⤵
        
        PID:3780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\lsass.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Desktop\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\providercommon\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files\MSBuild\Microsoft\taskhostw.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
d63ff49d7c92016feb39812e4db10419

SHA1
2307d5e35ca9864ffefc93acf8573ea995ba189b

SHA256
375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12

SHA512
00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d2d85f611d472414692e8a398e20ece

SHA1
fde7e1e8e748f5d7a5bdc7c3117b9fbbf4d7a21c

SHA256
e0f330c88071425737e217916ab2c744c065bdd65b6f819afbfdcc02ed34904c

SHA512
f0cf9470f34faa7f2a96700dfdb198e7c39b09cbeba9e288fec8229832c9b61ba71bccf60214f6bd2f287daaf821addaca40ac3b1067020e8d8102cf3ef93600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dbe7fe2a8251c5b198647b1e7da68e9c

SHA1
5d50175e9a0c41134ac1d3891067f922f56ef3f4

SHA256
803c7c8b0df0a5461fa56b79050461c2f11bf81c93fb0c9e6371b0404c661e4c

SHA512
34fcff39683033b4022d1d377f083000b1625222d596cc2956ae7851f0f887d99c45953ba766ad071dd5b5bf1f2b5945dd12a841699bbf0564c24c51ea3d83e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dbe7fe2a8251c5b198647b1e7da68e9c

SHA1
5d50175e9a0c41134ac1d3891067f922f56ef3f4

SHA256
803c7c8b0df0a5461fa56b79050461c2f11bf81c93fb0c9e6371b0404c661e4c

SHA512
34fcff39683033b4022d1d377f083000b1625222d596cc2956ae7851f0f887d99c45953ba766ad071dd5b5bf1f2b5945dd12a841699bbf0564c24c51ea3d83e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dbe7fe2a8251c5b198647b1e7da68e9c

SHA1
5d50175e9a0c41134ac1d3891067f922f56ef3f4

SHA256
803c7c8b0df0a5461fa56b79050461c2f11bf81c93fb0c9e6371b0404c661e4c

SHA512
34fcff39683033b4022d1d377f083000b1625222d596cc2956ae7851f0f887d99c45953ba766ad071dd5b5bf1f2b5945dd12a841699bbf0564c24c51ea3d83e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d31eda0032f0e098e0c6f97e007e45c

SHA1
8d55c255ed63d5d13771c50086cc91fbd08f77ed

SHA256
c2483153d5efda93bbef64c74e56e56c3e7f02b1e1aea2d0372f5897cf6f9653

SHA512
bd2cbc7adc6e403e6b372d7482d2374fe9e71c4c2a3e2e4e97c94f302985666c8c83b27954c726a9224a56c3c703d57d79beecc93f8f904db1537b0c7c9b6148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2d31eda0032f0e098e0c6f97e007e45c

SHA1
8d55c255ed63d5d13771c50086cc91fbd08f77ed

SHA256
c2483153d5efda93bbef64c74e56e56c3e7f02b1e1aea2d0372f5897cf6f9653

SHA512
bd2cbc7adc6e403e6b372d7482d2374fe9e71c4c2a3e2e4e97c94f302985666c8c83b27954c726a9224a56c3c703d57d79beecc93f8f904db1537b0c7c9b6148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fb08b11676cad8be0cef471cb6aed2a3

SHA1
9e3e31b75102eadbc2e69f199b249af8578739c2

SHA256
9f16a34c962806c63a21dedd822cf573043834e01499f092f5a3bbe52d8a9359

SHA512
fa51032885737454c4439640fa4ff86a6dcc5acedce171bb638482d1d6c792392001c18d92a2cb959aed72bc2115619b6003ed3badddaef6b052b198dd929d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
02f31baa91c53d4a16bc1d3cff7cfd9f

SHA1
440e3818dc72afb0569fc5b3de2eedc2815d4a0c

SHA256
d03b7789d2d7ab8332f252d0dac030352905cd770749a950a85472ccc41dce45

SHA512
a936bb4753139ce133fd20c7b713b8cd297b7c0f14d74a1a312909352e328f7464e9c27f3da2b2e846391034988b63abbdc449580fd924a46cf14dc4716fbb89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
02f31baa91c53d4a16bc1d3cff7cfd9f

SHA1
440e3818dc72afb0569fc5b3de2eedc2815d4a0c

SHA256
d03b7789d2d7ab8332f252d0dac030352905cd770749a950a85472ccc41dce45

SHA512
a936bb4753139ce133fd20c7b713b8cd297b7c0f14d74a1a312909352e328f7464e9c27f3da2b2e846391034988b63abbdc449580fd924a46cf14dc4716fbb89

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dhy3B39XM.bat

Filesize
213B

MD5
f50a82ca32f6a2605ec5fa02e80c5bfc

SHA1
46415f372eae603d247d1ff079fc1f197c81dc23

SHA256
a05da19ac68203a9c416754b7897f92b20bc13687a8d3c7148f94bd8f031ee74

SHA512
cddaf8fe12ec92630bb2c915a638f292c4cf6ce97704e38194fa4dd1205bd0b8599d021cf725ba87eb064eb040e4f22a06565cb0f313ecfa6c86f66a886ce6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat

Filesize
213B

MD5
d535e88c64ec72c05a397461a46f4f89

SHA1
a4765e5048dbfe450d27bb19bfc7c74833daddb5

SHA256
24423866c082732f985f92bde7a3951cc5394113c6a8e652139f1f4e07a5f8e4

SHA512
79fa1ce1d918bb920042f638c1b795ee5d62311c2352136681b8d8414879537122330fd7254876b956544003dde1fa85daa1f09d177f0d551eb107ad1ed9a563

Download Submit
C:\Users\Admin\AppData\Local\Temp\LZh5ueQJla.bat

Filesize
213B

MD5
d4b74db9ac604d1ae371babfef8b7c0d

SHA1
20ce08b2c89c285ab4a33e4782bcf4ee32bf467b

SHA256
a73df92ed785d5455885529be6295052dfcd186075862582c5357bba5d4a3294

SHA512
43cd838a763b96f3d3bd777f0bf45b6fad003e7d758f38ef267eeba9ba5b8d190396dace914de5983e023a6dd19bad0625a1266818104579d854bcc938b64176

Download Submit
C:\Users\Admin\AppData\Local\Temp\PGGCz4Ehy5.bat

Filesize
213B

MD5
0d41b7e7dfd0646382e90a0e83309eca

SHA1
8d319fe4ca27ad419e8b90c63fd676d66cc095cf

SHA256
1e3bc225a15abd1eae62efabf204da0ad429277d076d29e3f18b3b33575a709a

SHA512
4075d1d02cb08ba27e1f0054149bf3d9ba86dc5a9906d41c05ac0a6bc9992fe76a0db3d661182a79062159cd176f2e03ba9c831abfcd6357f2614b1206d32d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\SNnEytbzjv.bat

Filesize
213B

MD5
6f310eaa06f9edca3a5428baa9e59e36

SHA1
4ecc5b1778ad5508acff1b36535a77c568834fb9

SHA256
c555aee3de6126826ab69b6478577cad28051efc3fe57f17bdf39b198989e3b4

SHA512
4b3503c9aaa554e291e766e7f41bc0e0678bf21d974f36ded392f858bf7cbefd1727241d1a6dc3bd6d4312c25c0e1af834c01ff8c5b51e4902140c76d74564e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6uRiEqY03.bat

Filesize
213B

MD5
50ae2ed84febc0d4cbafc2fc19defc79

SHA1
e674bd85c2bd45061855ddc0a8bf5eb9a8f9cecb

SHA256
a530221b088e0d0fa4b809d28b41a207c6dc04baada2dc5d59a826ad253112a1

SHA512
022d69331a39f306efbf8c88dd6e1b157928bf447a8313d9b440a2dc9db63320dd939e71d0256aa74e79001e7bb18264565a9b3051c69359dbc0b0041961da75

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8IMWcflW5.bat

Filesize
213B

MD5
2d465be1d0b893f9bdacb109ac20c9b3

SHA1
80c7b981f6331f943984a013fd1050de1b46173e

SHA256
d02e7934534a8528ccfc86e7b0f9cc531b8d8b86548dc65a205f3628e892871f

SHA512
829578ca1e6cd42ff7c4f3dc8829616b9a5b13b7002eeeadf06c8e0a58f2ac2d22cb7d32e24934259d1cbb8d806e5d5dbcb1999740744e57b60c9b2b2d2535b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\l7tVtcAquU.bat

Filesize
213B

MD5
15cd66d6551d558bfda94c9411289d63

SHA1
a6a8b59e9e0f511d9065e27c99741dabea3e565d

SHA256
8eb81637559b453a33216f2ed0e3c76679ffacd6e08edb13c2805749a07b2ed9

SHA512
e00514668b483443a752b469d1eb2bea347c95dc40918146f56e272e14e39e9901252c241e9d03b33b84192f2ac52a4a293229173764f682661e10e96771af9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\m1XclINWiF.bat

Filesize
213B

MD5
ed9e57837cd894651cbbaa4594d65eb1

SHA1
f7fbab3432e6c857429fbcc5b645505f47955fdb

SHA256
2e64744e5099678b9e3daa6c520f06bc41b60afc345970b17491076ff711dfd1

SHA512
781bf49e32fe9445a32e24de89c4e3e287aa3bdd1718112aa64a2d617b881676a87aa66b392a4da4124a8665632d0b0e3901fc6958f94ff12d69355e94c23d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

Filesize
213B

MD5
bfdbb342d41b7cf013b5a94192c59f24

SHA1
fa828a8e83830b2674af7d39ebdd4970a27946a8

SHA256
d4f3b13381a4eccf5edf1220effe88928d09bf508a692f77121619e5b800fea2

SHA512
2dd5bacca72b4fe7b8f54dff5024e5a2b577dfdf944441b17d827ba2e727019e2fc55701b640b9e1f0ddb54fea02b4184401952e985969230299d95f16f182cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

Filesize
213B

MD5
43eeb5f4a62ab5a69c066909919f12c5

SHA1
f8e4083cf5b8e4a401d72247076a09ee1330ed32

SHA256
0f39790bd2fab531bb440d1869e42e454284b76422bf9128a5c879f70a02947d

SHA512
e2ca9b0deef9d00f86c4b3193d8dce2e93c8f390f95f6c212344891c9d7a3308af136db1f656c02b7d4df1c50a380eac02e700e631e3f436d59a64b1e5d6d8f9

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1556-348-0x0000015A7B110000-0x0000015A7B186000-memory.dmp

Filesize
472KB

Download
memory/1832-341-0x00000188E0EC0000-0x00000188E0EE2000-memory.dmp

Filesize
136KB

Download
memory/2588-684-0x0000000002BF0000-0x0000000002C02000-memory.dmp

Filesize
72KB

Download
memory/3204-288-0x0000000000A70000-0x0000000000A7C000-memory.dmp

Filesize
48KB

Download
memory/3204-287-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/3204-286-0x0000000000A40000-0x0000000000A4C000-memory.dmp

Filesize
48KB

Download
memory/3204-285-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download
memory/3204-284-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/4028-343-0x000000001C140000-0x000000001C152000-memory.dmp

Filesize
72KB

Download
memory/4324-147-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-137-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-164-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-163-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-162-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-166-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-161-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-167-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-160-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-159-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-158-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-157-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-156-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-155-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-154-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-153-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-152-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-150-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-151-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-149-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-148-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-174-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-146-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-145-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-144-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-118-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-119-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-143-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-175-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-120-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-142-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-169-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-141-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-140-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-170-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-139-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-138-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-121-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-165-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-176-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-168-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-135-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-171-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-123-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-136-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-177-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-134-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-133-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-124-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-132-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-178-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-172-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-131-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-173-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-179-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-129-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-126-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-180-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-130-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-181-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-128-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-127-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4572-183-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4572-184-0x00000000776D0000-0x000000007785E000-memory.dmp

Filesize
1.6MB

Download
memory/4628-667-0x0000000000E40000-0x0000000000E52000-memory.dmp

Filesize
72KB

Download
memory/4956-678-0x00000000014F0000-0x0000000001502000-memory.dmp

Filesize
72KB

Download
memory/5116-656-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download