dcrat | 8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe
Size

1.3MB
MD5

6e7bacb78194d8889fcb0777d9ea94bd
SHA1

04b561e8253382d904d701db2cc846665cb1abac
SHA256

8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c
SHA512

1604e76e3b1bae63702d3a0afa915db5675fcbd9c757b2f0561a46be19644e508a9430fb49a7b585e91682a0ae99bc6b2fb39bfd1928c8615e18a559115aeea7
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	3488	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	3488	schtasks.exe

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\providercommon\DllCommonsvc.exe	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
behavioral1/memory/3676-139-0x0000000000220000-0x0000000000330000-memory.dmp	dcrat
C:\providercommon\DllCommonsvc.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat
C:\Recovery\WindowsRE\Registry.exe	dcrat

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Registry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeWScript.exeDllCommonsvc.exeRegistry.exeRegistry.exe8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe

Executes dropped EXE 11 IoCs

Processes:

DllCommonsvc.exeDllCommonsvc.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exe

pid	process
3676	DllCommonsvc.exe
2484	DllCommonsvc.exe
5448	Registry.exe
6068	Registry.exe
2092	Registry.exe
4456	Registry.exe
3612	Registry.exe
2128	Registry.exe
1372	Registry.exe
3180	Registry.exe
4188	Registry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 14 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Program Files\WindowsPowerShell\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\SearchApp.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\38384e6a620884	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\27d1bcfc3c54e0	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

DllCommonsvc.exe

description	ioc	process
File created	C:\Windows\Migration\WTR\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\5b884080fd4f94	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1580	schtasks.exe
4940	schtasks.exe
3028	schtasks.exe
3244	schtasks.exe
5028	schtasks.exe
2276	schtasks.exe
4636	schtasks.exe
4528	schtasks.exe
1404	schtasks.exe
2008	schtasks.exe
448	schtasks.exe
2468	schtasks.exe
4320	schtasks.exe
2056	schtasks.exe
4708	schtasks.exe
3472	schtasks.exe
4492	schtasks.exe
3036	schtasks.exe
2220	schtasks.exe
4780	schtasks.exe
3296	schtasks.exe
2352	schtasks.exe
1524	schtasks.exe
4184	schtasks.exe
380	schtasks.exe
376	schtasks.exe
2908	schtasks.exe
4976	schtasks.exe
3256	schtasks.exe
3868	schtasks.exe
3476	schtasks.exe
1372	schtasks.exe
1728	schtasks.exe
2064	schtasks.exe
3808	schtasks.exe
4144	schtasks.exe
5056	schtasks.exe
4204	schtasks.exe
3264	schtasks.exe
2284	schtasks.exe
4088	schtasks.exe
1820	schtasks.exe
2372	schtasks.exe
4200	schtasks.exe
4268	schtasks.exe
3184	schtasks.exe
748	schtasks.exe
2776	schtasks.exe
3584	schtasks.exe
4640	schtasks.exe
4348	schtasks.exe
1620	schtasks.exe
2720	schtasks.exe
1864	schtasks.exe

Modifies registry class 10 IoCs

Processes:

Registry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exe8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exeRegistry.exeRegistry.exeRegistry.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	Registry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
3676	DllCommonsvc.exe
3676	DllCommonsvc.exe
3676	DllCommonsvc.exe
3676	DllCommonsvc.exe
3676	DllCommonsvc.exe
340	powershell.exe
532	powershell.exe
204	powershell.exe
532	powershell.exe
340	powershell.exe
204	powershell.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
2484	DllCommonsvc.exe
5080	powershell.exe
5080	powershell.exe
4452	powershell.exe
4452	powershell.exe
1980	powershell.exe
1980	powershell.exe
5076	powershell.exe
5076	powershell.exe
4024	powershell.exe
4024	powershell.exe
5060	powershell.exe
5060	powershell.exe
4216	powershell.exe
4216	powershell.exe
3864	powershell.exe
3864	powershell.exe
4524	powershell.exe
4524	powershell.exe
308	powershell.exe
308	powershell.exe
408	powershell.exe
408	powershell.exe
1748	powershell.exe
1748	powershell.exe
4880	powershell.exe
4880	powershell.exe
3976	powershell.exe
3976	powershell.exe
4344	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

DllCommonsvc.exepowershell.exepowershell.exepowershell.exeDllCommonsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exeRegistry.exe

description	pid	process
Token: SeDebugPrivilege	3676	DllCommonsvc.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	2484	DllCommonsvc.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	5448	Registry.exe
Token: SeDebugPrivilege	6068	Registry.exe
Token: SeDebugPrivilege	2092	Registry.exe
Token: SeDebugPrivilege	4456	Registry.exe
Token: SeDebugPrivilege	3612	Registry.exe
Token: SeDebugPrivilege	2128	Registry.exe
Token: SeDebugPrivilege	1372	Registry.exe
Token: SeDebugPrivilege	3180	Registry.exe
Token: SeDebugPrivilege	4188	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exeWScript.execmd.exeDllCommonsvc.exeDllCommonsvc.exeRegistry.execmd.exeRegistry.execmd.exe

description	pid	process	target process
PID 5036 wrote to memory of 4480	5036	8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe	WScript.exe
PID 5036 wrote to memory of 4480	5036	8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe	WScript.exe
PID 5036 wrote to memory of 4480	5036	8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe	WScript.exe
PID 4480 wrote to memory of 2740	4480	WScript.exe	cmd.exe
PID 4480 wrote to memory of 2740	4480	WScript.exe	cmd.exe
PID 4480 wrote to memory of 2740	4480	WScript.exe	cmd.exe
PID 2740 wrote to memory of 3676	2740	cmd.exe	DllCommonsvc.exe
PID 2740 wrote to memory of 3676	2740	cmd.exe	DllCommonsvc.exe
PID 3676 wrote to memory of 204	3676	DllCommonsvc.exe	powershell.exe
PID 3676 wrote to memory of 204	3676	DllCommonsvc.exe	powershell.exe
PID 3676 wrote to memory of 340	3676	DllCommonsvc.exe	powershell.exe
PID 3676 wrote to memory of 340	3676	DllCommonsvc.exe	powershell.exe
PID 3676 wrote to memory of 532	3676	DllCommonsvc.exe	powershell.exe
PID 3676 wrote to memory of 532	3676	DllCommonsvc.exe	powershell.exe
PID 3676 wrote to memory of 2484	3676		DllCommonsvc.exe
PID 3676 wrote to memory of 2484	3676		DllCommonsvc.exe
PID 2484 wrote to memory of 5080	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 5080	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4452	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4452	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 1980	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 1980	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4024	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4024	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 5076	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 5076	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 5060	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 5060	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 3864	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 3864	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4216	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4216	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4524	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4524	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 308	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 308	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 408	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 408	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 1748	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 1748	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4880	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4880	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 3976	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 3976	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4344	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 4344	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 3548	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 3548	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 2304	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 2304	2484	DllCommonsvc.exe	powershell.exe
PID 2484 wrote to memory of 5448	2484	DllCommonsvc.exe	Registry.exe
PID 2484 wrote to memory of 5448	2484	DllCommonsvc.exe	Registry.exe
PID 5448 wrote to memory of 5768	5448	Registry.exe	cmd.exe
PID 5448 wrote to memory of 5768	5448	Registry.exe	cmd.exe
PID 5768 wrote to memory of 5864	5768	cmd.exe	w32tm.exe
PID 5768 wrote to memory of 5864	5768	cmd.exe	w32tm.exe
PID 5768 wrote to memory of 6068	5768	cmd.exe	Registry.exe
PID 5768 wrote to memory of 6068	5768	cmd.exe	Registry.exe
PID 6068 wrote to memory of 948	6068	Registry.exe	cmd.exe
PID 6068 wrote to memory of 948	6068	Registry.exe	cmd.exe
PID 948 wrote to memory of 816	948	cmd.exe	w32tm.exe
PID 948 wrote to memory of 816	948	cmd.exe	w32tm.exe
PID 948 wrote to memory of 2092	948	cmd.exe	Registry.exe
PID 948 wrote to memory of 2092	948	cmd.exe	Registry.exe

C:\Users\Admin\AppData\Local\Temp\8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe
"C:\Users\Admin\AppData\Local\Temp\8fe8a0b927129e1b4ba1c78ed7890a169ec2093a15ef4a5d95e8acb507a2bf0c.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SppExtComObj.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:532

C:\providercommon\DllCommonsvc.exe
"C:\providercommon\DllCommonsvc.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\winlogon.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OfficeClickToRun.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\conhost.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Registry.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\reports\csrss.exe'
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\SearchApp.exe'
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\locale\af\RuntimeBroker.exe'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:5768

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:5864

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
9⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat"
11⤵
PID:3620

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
12⤵
PID:4328

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat"
13⤵
PID:5348

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
14⤵
PID:1336

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"
15⤵
PID:220

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
16⤵
PID:3260

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat"
17⤵
PID:2064

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
18⤵
PID:1944

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat"
19⤵
PID:3032

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
20⤵
PID:5076

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
21⤵
PID:1360

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
22⤵
PID:2276

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
23⤵
PID:2464

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
24⤵
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\providercommon\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\providercommon\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\locale\af\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\af\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\locale\af\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\reports\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Temp\Crashpad\reports\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Recovery\WindowsRE\Registry.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log
Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
492262f32fa532eb99eac6884eb65b30

SHA1
2c642386a41e8f7dfe8600f0e4ce8fe1fbdc1bf7

SHA256
e09a89213fee09d5f4a75c424f3356d41b70aecb906b5afb597c1806939990ef

SHA512
525520aeb31166f9b28830a4e9160e64c39d0f7d8402ab2e5aba34f3a9db9755d78b8ac0b4a4022487efaa285ade52a2caf6db56043ff371616064d130553fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
34477c71724989cda19ddd7a5a4d7b29

SHA1
debaa011b19ba910190607cc62ed2ec2212dfa0c

SHA256
59a4123ada3faee2ab3d8be31e8b523c574acc9ade3761a4564db03f83190c98

SHA512
c61d2254e664ce601c58eae8ed3d0346ca399a780587ed884db66db5e345725597b8076fd6d0ada823df034d227f004a1c545d9f9fb6c7349adcfeb8215beee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
65995df72c3e88a1d1d15c170b49d777

SHA1
fca702296954192da52b0f4bb51bca26bebe0e52

SHA256
3e74f281e83a0ce8b5d15d7cacae7e02e7773b1321ab53ad377437ef6ef78915

SHA512
5f8b488e3e12411f4db9e9c6f67bb384bd474065f659c4028fd12324c6db8440318a818716d83e589f8b7e10875df65348bac0e60ac7bb790b5430e94b746aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
65995df72c3e88a1d1d15c170b49d777

SHA1
fca702296954192da52b0f4bb51bca26bebe0e52

SHA256
3e74f281e83a0ce8b5d15d7cacae7e02e7773b1321ab53ad377437ef6ef78915

SHA512
5f8b488e3e12411f4db9e9c6f67bb384bd474065f659c4028fd12324c6db8440318a818716d83e589f8b7e10875df65348bac0e60ac7bb790b5430e94b746aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
65995df72c3e88a1d1d15c170b49d777

SHA1
fca702296954192da52b0f4bb51bca26bebe0e52

SHA256
3e74f281e83a0ce8b5d15d7cacae7e02e7773b1321ab53ad377437ef6ef78915

SHA512
5f8b488e3e12411f4db9e9c6f67bb384bd474065f659c4028fd12324c6db8440318a818716d83e589f8b7e10875df65348bac0e60ac7bb790b5430e94b746aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
7cc35bae31b6e945e0807cb0601744d6

SHA1
90e8897f492466a240eb14dbc78bb7ddb149fbd3

SHA256
6ad98cbc6cd6578dff4df79b3a04959df32ecd0c383be437085a99dfc6b40183

SHA512
dca3bbd4c43d27985c14770436a270b586a45f27616ecc9dad8f50eaac5cfcde9dc7e529b1b890c75a3c2420c4536c7332796b5c6de468bea988dc362ba14d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
76de0d381ca270b0d7daa729b8040090

SHA1
3aefa584da0da87c1ef7b24b5eff0fca29348f54

SHA256
01768f5b8af8d74fe499a48537bf897f995ebab0ce3054c3a54fb48d2d7e7d93

SHA512
c305a3a6193bef8766e90e378735b2e343fa22134c177f977a1ccd6394717b33d523071374dcca5759cf7050745d496995f0c9eed944550d44cfe7b7766e01d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
15b45335e7c2e7f19c76c86c0dc44f25

SHA1
541b528c4e73f038961f778b708a51d3e80429b4

SHA256
a6bca4723b2c559fb4a7526470f3b595d0a4d6e9e464e801faa57e6019d47a74

SHA512
fa9d898d9eef5844bdfa3f39c88e7a21656a7767e0e19322e980ae5b57520941a1327acde83427a5c06eae4af4e618bf9749bc319e60cd81d924edb3e665b7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
4a40b6dc9559e70af09a5466cba5abc6

SHA1
d4cfd42fe9afe6c43489950849d9cd38302cb4d6

SHA256
743601e30b004830c766fe094f50404ab1e82eefb07f113417c11c1b70fbf861

SHA512
70387883cfdbc3ebbf46d73cc0bd9039db5fc02f48bdafb20f0f50c4c4368ddf834e2675a061e1feb3c7865d0187554e0656f5962327f28a3538b29e994f8519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
4a40b6dc9559e70af09a5466cba5abc6

SHA1
d4cfd42fe9afe6c43489950849d9cd38302cb4d6

SHA256
743601e30b004830c766fe094f50404ab1e82eefb07f113417c11c1b70fbf861

SHA512
70387883cfdbc3ebbf46d73cc0bd9039db5fc02f48bdafb20f0f50c4c4368ddf834e2675a061e1feb3c7865d0187554e0656f5962327f28a3538b29e994f8519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2c5be14933f61737d2dba0e3d797ce24

SHA1
28abeb5ab249fe37338fd10fae1a1a12f75026cb

SHA256
93c49405dd6d88987ff03b3818aceefc2fb308951346d9901e33f8080aa2fb20

SHA512
4fe2004e6b77a6a9dda19ce36af914429641d50e2bb560eccd9928d490da9a170c2b939e72d3441586fe224ae7919cda421b31befe50e03fe2f7a7181225ce19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
595bd16cb49725e4428e784d1f6e8075

SHA1
14ab5982b26ab60b4da9986e7411e2e8094b84cf

SHA256
a6670c611c0ed41a0111bf003f0879e5855b49f358c32254b8f3011745e98998

SHA512
162881a0dd3f96a8d0e3bdd75157964e8478b0fd630c5d8aa137b9e50c9e456ad107ddd7a9449b2320f8fe758ceedad4380687350601d55e9c6334627c80ab7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
595bd16cb49725e4428e784d1f6e8075

SHA1
14ab5982b26ab60b4da9986e7411e2e8094b84cf

SHA256
a6670c611c0ed41a0111bf003f0879e5855b49f358c32254b8f3011745e98998

SHA512
162881a0dd3f96a8d0e3bdd75157964e8478b0fd630c5d8aa137b9e50c9e456ad107ddd7a9449b2320f8fe758ceedad4380687350601d55e9c6334627c80ab7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
4822327741294722927d46423be14304

SHA1
3049826ae49ca304bd4a84a21b8ccb6a9499c39e

SHA256
b6ed5510a3376ce391d154b219c2d70cebb62e6fdef97022ad2bc305c5137a74

SHA512
c7607f4bab5688baaeab93bc92a2546d60f9f77b52614ad718133e4313674ae3bdbd497282220c399b2cd97c45a09adbecf1997ac82cab9e221129fa3ac83c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2b620c0f6c0fc1d433ad27ab232ea74c

SHA1
0934b76bcc56771113e4a90a860934e5bd4bd5e3

SHA256
132902dc50808adfed74bf516ae2daa39a84cb35e2452ba25b404ad8cdf84af8

SHA512
58a97f16759b043e23ed07b8d56acb8e02b67ca58956dcb5bd3da3d4586c4806c4ae4a894df41f9c197c7f3cafb61f7cd3ca0c71b66f99c7cef4c3eeac60dc3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
1aca6db16211f202d2ea4849f0c3ad3b

SHA1
cfb4332df11774f96313ad62b4dc9dc8cf1e632e

SHA256
2cfef95b36ca39cb7949287af66efced1646ade2293fca0a0157f3957278ba90

SHA512
de22fa723d26ea33fc9a9d25172e5fe2f87f5db458101e139b35646a3157fdf0533e7b60559c31ad64551000a4494b852ce38d88e44837fa64db4b4087d91a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\MXvuXcjR4o.bat
Filesize
199B

MD5
6608a9999341b6f10e0085323d167c57

SHA1
e0436d9c16281cdbe45962e527902f0ede7e8e5e

SHA256
f6e376a0f34421b02c0df8aa5ec7eb31874449f99bdb56ac244651feb69e938b

SHA512
40ca99cfdb8615ce3a3d0b6adb5249629a040679a9b7e9d5226da3f42b47aa5e6ebeb6736826b04b11ebc4a7fe2ed9158e301f106cd6abb15c43e3bf2868dd3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat
Filesize
199B

MD5
c15fddb97766b619209f68a17d97bb80

SHA1
bd650e2602686c4ef7c97be8141688ec23a01566

SHA256
4d736648c2298f38f1432a9e39abebc9922e5f4c312579f01f3bd63af4385616

SHA512
5b2d2f968c46304a621877cdc1f2b36d39590c9ff4d941fcfa6b41f9e0227a74030b50302f94a79454779c0297e0491f4efd013a1217d4fabbc48f3cd333759c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat
Filesize
199B

MD5
cd5a7b3180b5e068dd3ad7f98d43ec3b

SHA1
39f7c93b4d07552810e2de57b03178ecd4f7a107

SHA256
551dc489bda093a6487777a1577c337fe70b31b05e90411dfdea54c7dfb82f7f

SHA512
941839b4e6c3b1b057a29dfb87e6f7569479be45a0c4f082266c16949f71c0f752834364b6ad5bf45fbd514d6e73687b420c7ac444cdeafa2f98228887379b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat
Filesize
199B

MD5
5329233cc24f4715fb3594a9414e1ed0

SHA1
e40769a385ba538d9da265be4ef1a7e546b6549d

SHA256
f219f5f8cab02bd2532f32bfad47e20f2fef63281dbd2959e235505f904dec01

SHA512
27e4dd2dba921decd66a5b7a7f40fd5c042cfc5c97dbb20981cb00588ed69c3df041f76bf649e27fe0124a5407d6396af8fa6c703bbda063557280ff7a53cbc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\pCeLVPpGxY.bat
Filesize
199B

MD5
921324be5d4da0e460416bd1261c82e4

SHA1
607117b18479faa3ce5b80e23e51fb95c6b8305a

SHA256
6046780b5eaacfb0d5e0ed584366d822cd7cc8dc1f470e5f515e61e580e2c922

SHA512
f04351796ffef2dd7e393b19383abd9602d83f382aaaaf5bcbc4aa7c95847c5e4b8e97d35dce57258b375c33f14be056e677440df6beba925a34672408da09c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat
Filesize
199B

MD5
92085dab4925c5e13ac2b83bf6f6ff3b

SHA1
eee5210c9d60181e3c45dbfae256f40570c2ba08

SHA256
47d9895c4cae807eb51698fee89812ae47951885f9e96baccc5ce2ae4e9edaed

SHA512
998e99a521c968d3b243dfb856f364b638452038303bbbf2040c365466f09b694d9fc4bbc4f71664c8d13fe3cc8f35115185b1aa7841ea6524a9e7bce30350fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\t3iRsZx2b7.bat
Filesize
199B

MD5
256f4b6ad702f3dd439c3a888683fa8b

SHA1
0e1d0e12ec25d6c5775c5966b62f2fdc5db0d6d4

SHA256
f759a1013d96ecba7b6c17692303334f89127617b24b5d0113340b0e32291bef

SHA512
57a84ce37c143523e0f0b0e39e35ab3d9fb647e02ad5f9f89feba01cba3614763084034d456c15b64f6c44dd4baf2082c034a597a43437c7b3b0d00d4ea6f1f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat
Filesize
199B

MD5
e2eb8d0edb25e683c43d330ed5c8acb3

SHA1
ebf601d5135422be84db902dea2c9bbaf0ab8858

SHA256
76e8a611d663ee9ced658ccf7ccacd8c8a9878dd1f9514e8844a970f50bba8ae

SHA512
ab1903ef171be1e0e3b1575772a0f66fe8e402a2a9fecb0dafbc9a3162bc1764ae2f0e893d0e164884d59d95106136e8b58377db4b78b6db421d751652fac5f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat
Filesize
199B

MD5
e2eb8d0edb25e683c43d330ed5c8acb3

SHA1
ebf601d5135422be84db902dea2c9bbaf0ab8858

SHA256
76e8a611d663ee9ced658ccf7ccacd8c8a9878dd1f9514e8844a970f50bba8ae

SHA512
ab1903ef171be1e0e3b1575772a0f66fe8e402a2a9fecb0dafbc9a3162bc1764ae2f0e893d0e164884d59d95106136e8b58377db4b78b6db421d751652fac5f9

Download Submit
C:\providercommon\1zu9dW.bat
Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe
Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe
Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/204-157-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/204-149-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/204-141-0x0000000000000000-mapping.dmp

Download
memory/220-261-0x0000000000000000-mapping.dmp

Download
memory/308-196-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/308-184-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/308-167-0x0000000000000000-mapping.dmp

Download
memory/340-150-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/340-148-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/340-142-0x0000000000000000-mapping.dmp

Download
memory/408-168-0x0000000000000000-mapping.dmp

Download
memory/408-185-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/408-210-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/532-143-0x0000000000000000-mapping.dmp

Download
memory/532-151-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/532-146-0x00000194F1F00000-0x00000194F1F22000-memory.dmp

Filesize
136KB

Download
memory/532-156-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/816-242-0x0000000000000000-mapping.dmp

Download
memory/948-240-0x0000000000000000-mapping.dmp

Download
memory/1336-256-0x0000000000000000-mapping.dmp

Download
memory/1360-282-0x0000000000000000-mapping.dmp

Download
memory/1372-278-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/1372-274-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/1372-272-0x0000000000000000-mapping.dmp

Download
memory/1748-216-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/1748-169-0x0000000000000000-mapping.dmp

Download
memory/1748-186-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/1944-270-0x0000000000000000-mapping.dmp

Download
memory/1980-160-0x0000000000000000-mapping.dmp

Download
memory/1980-199-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/1980-177-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2064-268-0x0000000000000000-mapping.dmp

Download
memory/2092-244-0x0000000000000000-mapping.dmp

Download
memory/2092-246-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2092-250-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2128-265-0x0000000000000000-mapping.dmp

Download
memory/2128-267-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/2128-271-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/2276-284-0x0000000000000000-mapping.dmp

Download
memory/2304-189-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2304-174-0x0000000000000000-mapping.dmp

Download
memory/2304-228-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2464-289-0x0000000000000000-mapping.dmp

Download
memory/2484-152-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2484-226-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/2484-144-0x0000000000000000-mapping.dmp

Download
memory/2740-135-0x0000000000000000-mapping.dmp

Download
memory/3032-275-0x0000000000000000-mapping.dmp

Download
memory/3180-285-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/3180-281-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/3180-279-0x0000000000000000-mapping.dmp

Download
memory/3260-263-0x0000000000000000-mapping.dmp

Download
memory/3548-173-0x0000000000000000-mapping.dmp

Download
memory/3548-188-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3548-225-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3612-260-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3612-264-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3612-258-0x0000000000000000-mapping.dmp

Download
memory/3620-247-0x0000000000000000-mapping.dmp

Download
memory/3676-147-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3676-140-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3676-139-0x0000000000220000-0x0000000000330000-memory.dmp

Filesize
1.1MB

Download
memory/3676-136-0x0000000000000000-mapping.dmp

Download
memory/3864-215-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3864-164-0x0000000000000000-mapping.dmp

Download
memory/3864-182-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3976-171-0x0000000000000000-mapping.dmp

Download
memory/3976-187-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/3976-224-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4024-161-0x0000000000000000-mapping.dmp

Download
memory/4024-202-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4024-178-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4188-288-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/4188-286-0x0000000000000000-mapping.dmp

Download
memory/4188-292-0x00007FFAB7160000-0x00007FFAB7C21000-memory.dmp

Filesize
10.8MB

Download
memory/4216-183-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4216-165-0x0000000000000000-mapping.dmp

Download
memory/4216-211-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4260-291-0x0000000000000000-mapping.dmp

Download
memory/4328-249-0x0000000000000000-mapping.dmp

Download
memory/4344-192-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4344-172-0x0000000000000000-mapping.dmp

Download
memory/4344-223-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4452-201-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4452-176-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4452-159-0x0000000000000000-mapping.dmp

Download
memory/4456-253-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4456-251-0x0000000000000000-mapping.dmp

Download
memory/4456-257-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4480-132-0x0000000000000000-mapping.dmp

Download
memory/4524-190-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4524-166-0x0000000000000000-mapping.dmp

Download
memory/4524-213-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4880-191-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4880-230-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/4880-170-0x0000000000000000-mapping.dmp

Download
memory/5060-181-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5060-163-0x0000000000000000-mapping.dmp

Download
memory/5060-209-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5076-204-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5076-277-0x0000000000000000-mapping.dmp

Download
memory/5076-162-0x0000000000000000-mapping.dmp

Download
memory/5076-179-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5080-158-0x0000000000000000-mapping.dmp

Download
memory/5080-175-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5080-195-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5348-254-0x0000000000000000-mapping.dmp

Download
memory/5448-231-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5448-233-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/5448-214-0x0000000000000000-mapping.dmp

Download
memory/5768-232-0x0000000000000000-mapping.dmp

Download
memory/5864-235-0x0000000000000000-mapping.dmp

Download
memory/6068-243-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download
memory/6068-236-0x0000000000000000-mapping.dmp

Download
memory/6068-239-0x00007FFAB6F70000-0x00007FFAB7A31000-memory.dmp

Filesize
10.8MB

Download