Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2023 05:01
Behavioral task
behavioral1
Sample
0b0ec65382f89a78a0fe6e8806692b3c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0b0ec65382f89a78a0fe6e8806692b3c.exe
Resource
win10v2004-20221111-en
General
-
Target
0b0ec65382f89a78a0fe6e8806692b3c.exe
-
Size
1.4MB
-
MD5
0b0ec65382f89a78a0fe6e8806692b3c
-
SHA1
c53d487fe509f97d8f25565afa6b93a7ddc5a32d
-
SHA256
025f59dd06ad2bd27f44923788303977c9c35274632bd4a0068a4d2d01faec5f
-
SHA512
7672df5a954cc1be0d507d9e87af0301d70f031ce083b0bb145ba5f45b4de3c5478c27b8f34e8c304e556728e81389c5cde30242f2bb40b3eff7ddbadb0c9c92
-
SSDEEP
24576:DnTvNh6VDOAxsd05hhdshr0SafxxyiDSvGzNlZhlUmbhL:DLNh6ViAxsqr6r0hfqY/lb2
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1672 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4384 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4980 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3196 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4320 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 460 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3540 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3808 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 112 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1540 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1408 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4020 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1464 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2516 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4740 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4352 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4456 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4332 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3452 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1832 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2452 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4940 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3888 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4196 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1296 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4580 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4756 4376 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4688 4376 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/860-132-0x0000000000600000-0x000000000076E000-memory.dmp dcrat C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe dcrat C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe dcrat behavioral2/memory/4512-168-0x0000000000E20000-0x0000000000F8E000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exepid process 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exe0b0ec65382f89a78a0fe6e8806692b3c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 0b0ec65382f89a78a0fe6e8806692b3c.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Drops file in Program Files directory 50 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exedescription ioc process File created C:\Program Files\Windows Multimedia Platform\wininit.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\9e8d7a4ca61bd9 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows Mail\6cb0b6c459d5d3 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\RCXB20B.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXB944.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\System.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows NT\Accessories\WmiPrvSE.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\spoolsv.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX8E40.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\System.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCX974E.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Mail\RCXB8C6.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Mail\dwm.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\66fc9ff0ee96c2 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows Mail\dwm.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\Idle.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Multimedia Platform\RCXA5FD.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Multimedia Platform\wininit.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\csrss.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\RCXB289.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\27d1bcfc3c54e0 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXBC44.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX8DB2.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCX96E0.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\RCX9FC0.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows Portable Devices\Idle.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files\Windows Media Player\it-IT\csrss.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\RCX9A3E.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\RCXAF8A.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows NT\Accessories\24dbde2999530e 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files\Windows Multimedia Platform\56085415360792 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Multimedia Platform\RCXA67B.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\RCXA8FD.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\RCXA97B.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\RCXBBC6.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\en-US\spoolsv.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows Photo Viewer\5940a34987c991 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\f3b6ecef712a24 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\RCX99C0.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\RCXA04D.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\RCXAF0C.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Windows Portable Devices\6ccacd8608530f 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files\Windows Media Player\it-IT\886983d96e3d3e 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\WmiPrvSE.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Drops file in Windows directory 13 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exedescription ioc process File created C:\Windows\CbsTemp\6cb0b6c459d5d3 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\Speech\Common\es-ES\backgroundTaskHost.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\Microsoft.NET\authman\taskhostw.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\CSC\backgroundTaskHost.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\CbsTemp\RCX90E1.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\CbsTemp\RCX915F.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\Microsoft.NET\authman\RCXAC0C.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\Microsoft.NET\authman\taskhostw.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\CbsTemp\dwm.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\explorer.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\Microsoft.NET\authman\ea9f0e6c9e2dcd 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\CbsTemp\dwm.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\Microsoft.NET\authman\RCXAC8A.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3540 schtasks.exe 3808 schtasks.exe 4020 schtasks.exe 1464 schtasks.exe 4900 schtasks.exe 1672 schtasks.exe 2056 schtasks.exe 460 schtasks.exe 2564 schtasks.exe 2452 schtasks.exe 4940 schtasks.exe 1408 schtasks.exe 1700 schtasks.exe 3452 schtasks.exe 4328 schtasks.exe 2724 schtasks.exe 2032 schtasks.exe 1880 schtasks.exe 3888 schtasks.exe 4756 schtasks.exe 4688 schtasks.exe 3196 schtasks.exe 2256 schtasks.exe 4740 schtasks.exe 4948 schtasks.exe 2516 schtasks.exe 5084 schtasks.exe 1796 schtasks.exe 228 schtasks.exe 4352 schtasks.exe 4652 schtasks.exe 4404 schtasks.exe 2412 schtasks.exe 4456 schtasks.exe 4332 schtasks.exe 448 schtasks.exe 1832 schtasks.exe 1960 schtasks.exe 4384 schtasks.exe 4980 schtasks.exe 2252 schtasks.exe 1296 schtasks.exe 4580 schtasks.exe 4196 schtasks.exe 1200 schtasks.exe 3836 schtasks.exe 1540 schtasks.exe 4868 schtasks.exe 1620 schtasks.exe 4320 schtasks.exe 112 schtasks.exe -
Modifies registry class 2 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exe0b0ec65382f89a78a0fe6e8806692b3c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0b0ec65382f89a78a0fe6e8806692b3c.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 4608 powershell.exe 2180 powershell.exe 3464 powershell.exe 3464 powershell.exe 2512 powershell.exe 2512 powershell.exe 668 powershell.exe 668 powershell.exe 3436 powershell.exe 3436 powershell.exe 3252 powershell.exe 3252 powershell.exe 444 powershell.exe 444 powershell.exe 2848 powershell.exe 2848 powershell.exe 4720 powershell.exe 4720 powershell.exe 4524 powershell.exe 4524 powershell.exe 4716 powershell.exe 4716 powershell.exe 4232 powershell.exe 4232 powershell.exe 4188 powershell.exe 4188 powershell.exe 1448 powershell.exe 1448 powershell.exe 976 powershell.exe 976 powershell.exe 2504 powershell.exe 2504 powershell.exe 2252 powershell.exe 2252 powershell.exe 2180 powershell.exe 2180 powershell.exe 4608 powershell.exe 4608 powershell.exe 3464 powershell.exe 3464 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exepid process 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe0b0ec65382f89a78a0fe6e8806692b3c.exedescription pid process Token: SeDebugPrivilege 860 0b0ec65382f89a78a0fe6e8806692b3c.exe Token: SeDebugPrivilege 4608 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 3464 powershell.exe Token: SeDebugPrivilege 2512 powershell.exe Token: SeDebugPrivilege 668 powershell.exe Token: SeDebugPrivilege 3436 powershell.exe Token: SeDebugPrivilege 3252 powershell.exe Token: SeDebugPrivilege 444 powershell.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 4720 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeDebugPrivilege 4716 powershell.exe Token: SeDebugPrivilege 4232 powershell.exe Token: SeDebugPrivilege 4188 powershell.exe Token: SeDebugPrivilege 1448 powershell.exe Token: SeDebugPrivilege 976 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2252 powershell.exe Token: SeDebugPrivilege 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exe0b0ec65382f89a78a0fe6e8806692b3c.exedescription pid process target process PID 860 wrote to memory of 4608 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4608 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2512 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2512 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2180 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2180 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 3436 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 3436 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 3464 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 3464 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 668 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 668 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 444 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 444 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 3252 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 3252 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2848 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2848 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4720 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4720 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4524 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4524 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4716 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4716 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4188 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4188 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4232 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4232 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 1448 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 1448 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 976 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 976 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2504 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2504 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2252 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 2252 860 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 860 wrote to memory of 4512 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe PID 860 wrote to memory of 4512 860 0b0ec65382f89a78a0fe6e8806692b3c.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe PID 4512 wrote to memory of 5400 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe WScript.exe PID 4512 wrote to memory of 5400 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe WScript.exe PID 4512 wrote to memory of 5520 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe WScript.exe PID 4512 wrote to memory of 5520 4512 0b0ec65382f89a78a0fe6e8806692b3c.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b0ec65382f89a78a0fe6e8806692b3c.exe"C:\Users\Admin\AppData\Local\Temp\0b0ec65382f89a78a0fe6e8806692b3c.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0b0ec65382f89a78a0fe6e8806692b3c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\System.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\dwm.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\WmiPrvSE.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Links\winlogon.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\sppsvc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:444 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\wininit.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\it-IT\csrss.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\authman\taskhostw.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dwm.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\spoolsv.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe"C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6795873e-9108-42df-b795-024b2c241170.vbs"3⤵PID:5400
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c2d4dc9-5f29-4b4f-81f9-677fa02f8c23.vbs"3⤵PID:5520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\CbsTemp\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\CbsTemp\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Links\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Links\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Links\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "0b0ec65382f89a78a0fe6e8806692b3c0" /sc MINUTE /mo 6 /tr "'C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "0b0ec65382f89a78a0fe6e8806692b3c" /sc ONLOGON /tr "'C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "0b0ec65382f89a78a0fe6e8806692b3c0" /sc MINUTE /mo 8 /tr "'C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\it-IT\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\Microsoft.NET\authman\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\authman\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\odt\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD522fbec4acba323d04079a263526cef3c
SHA1eb8dd0042c6a3f20087a7d2391eaf48121f98740
SHA256020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40
SHA512fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD522fbec4acba323d04079a263526cef3c
SHA1eb8dd0042c6a3f20087a7d2391eaf48121f98740
SHA256020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40
SHA512fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Temp\1c2d4dc9-5f29-4b4f-81f9-677fa02f8c23.vbsFilesize
495B
MD5c7a65fe6eab235fffab2064b5a7bdcb0
SHA131a5efcd1333a04f891df9e9b8906bb95964b855
SHA25695929039593b9cc29752cdef40e80b1b6ce8874c675bfcd2bce406da86bbf5c3
SHA51275a0a0325a27dbcddb494685f452c22754d6a906bab44bd187e74aa8656288a2d196f122ff16b729cf256df5a5e2a16174a655aa4a160dda6bd428fc9ccc94c5
-
C:\Users\Admin\AppData\Local\Temp\6795873e-9108-42df-b795-024b2c241170.vbsFilesize
719B
MD578ee92f7e0abbd94e8dd14d77be017e3
SHA18e3bb3c85b0e0a65372f01e45b5c50ecfdad2c36
SHA2562e204311fb95cae3cf267242ac0005cd8653f3f43467fcdee05e1bda543f8518
SHA5125ebbe5841db3e199a6d68e2befbb27b7dbfa8ac7c9edbfc490e4bf3106246bc00cb8017528e3b202b9502114a01ac9b90f3c95ef093388d93946da29d9fba86f
-
C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exeFilesize
1.4MB
MD5bb09a426a488546e7359d9b98d929b4b
SHA1cd19d5c8d07540a3b5e32709dfe64dd5ed247201
SHA256bf1c9855297684bb30972a05b98ef7c1b9d5fe44fad467fed07e2ee60abe4405
SHA512b0a4626cc4951a993a9ea90a44e2788b05a063b133adbeca06d270f0e689c27bc0e5782c613519be6f55139923f0c73a7191e3bf237530363464d6e8c37a4a22
-
C:\odt\0b0ec65382f89a78a0fe6e8806692b3c.exeFilesize
1.4MB
MD5bb09a426a488546e7359d9b98d929b4b
SHA1cd19d5c8d07540a3b5e32709dfe64dd5ed247201
SHA256bf1c9855297684bb30972a05b98ef7c1b9d5fe44fad467fed07e2ee60abe4405
SHA512b0a4626cc4951a993a9ea90a44e2788b05a063b133adbeca06d270f0e689c27bc0e5782c613519be6f55139923f0c73a7191e3bf237530363464d6e8c37a4a22
-
memory/444-142-0x0000000000000000-mapping.dmp
-
memory/444-191-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/444-161-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/668-160-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/668-189-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/668-141-0x0000000000000000-mapping.dmp
-
memory/860-133-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/860-132-0x0000000000600000-0x000000000076E000-memory.dmpFilesize
1.4MB
-
memory/860-135-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/860-134-0x00000000027C0000-0x0000000002810000-memory.dmpFilesize
320KB
-
memory/860-170-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/976-171-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/976-153-0x0000000000000000-mapping.dmp
-
memory/976-210-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/1448-218-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/1448-176-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/1448-151-0x0000000000000000-mapping.dmp
-
memory/2180-138-0x0000000000000000-mapping.dmp
-
memory/2180-148-0x000001E5EBA40000-0x000001E5EBA62000-memory.dmpFilesize
136KB
-
memory/2180-194-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2180-155-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2252-217-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2252-156-0x0000000000000000-mapping.dmp
-
memory/2252-181-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2504-216-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2504-172-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2504-154-0x0000000000000000-mapping.dmp
-
memory/2512-195-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2512-157-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2512-137-0x0000000000000000-mapping.dmp
-
memory/2848-173-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2848-182-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/2848-144-0x0000000000000000-mapping.dmp
-
memory/3252-143-0x0000000000000000-mapping.dmp
-
memory/3252-162-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/3252-183-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/3436-198-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/3436-139-0x0000000000000000-mapping.dmp
-
memory/3436-159-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/3464-140-0x0000000000000000-mapping.dmp
-
memory/3464-197-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/3464-158-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4188-169-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4188-212-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4188-149-0x0000000000000000-mapping.dmp
-
memory/4232-150-0x0000000000000000-mapping.dmp
-
memory/4232-213-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4232-165-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4512-168-0x0000000000E20000-0x0000000000F8E000-memory.dmpFilesize
1.4MB
-
memory/4512-219-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4512-164-0x0000000000000000-mapping.dmp
-
memory/4512-193-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4524-174-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4524-207-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4524-146-0x0000000000000000-mapping.dmp
-
memory/4608-152-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4608-136-0x0000000000000000-mapping.dmp
-
memory/4608-196-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4716-206-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4716-147-0x0000000000000000-mapping.dmp
-
memory/4716-175-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4720-145-0x0000000000000000-mapping.dmp
-
memory/4720-204-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/4720-163-0x00007FFA12860000-0x00007FFA13321000-memory.dmpFilesize
10.8MB
-
memory/5400-177-0x0000000000000000-mapping.dmp
-
memory/5520-192-0x0000000000000000-mapping.dmp