dcrat | 66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe
Size

1.3MB
MD5

23ac4dfead11eeaa808717d83d8eabc0
SHA1

4ea843831619fb35f8f94d30bcee9959a829c1a1
SHA256

66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683
SHA512

cc69aa8004ab764f15aa5072cde0f7db48b7aa3a54d29b3b3d29e1a4f8e7be34375aa5183fbcc03692b7e8b929d92e715c04e7c15816ba74f9c416cf02b1c6ad
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	1308	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	1308	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b74-10.dat	dcrat
behavioral2/memory/400-13-0x0000000000760000-0x0000000000870000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4024	powershell.exe
4628	powershell.exe
1264	powershell.exe
376	powershell.exe
1504	powershell.exe
4704	powershell.exe
2092	powershell.exe
4328	powershell.exe
1652	powershell.exe
208	powershell.exe
1592	powershell.exe
2516	powershell.exe
1588	powershell.exe
5052	powershell.exe
1144	powershell.exe
4288	powershell.exe
544	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe

Executes dropped EXE 11 IoCs

pid	Process
400	DllCommonsvc.exe
2236	DllCommonsvc.exe
4812	DllCommonsvc.exe
4832	DllCommonsvc.exe
2548	DllCommonsvc.exe
2748	DllCommonsvc.exe
2024	DllCommonsvc.exe
2536	DllCommonsvc.exe
5060	DllCommonsvc.exe
4916	DllCommonsvc.exe
1196	DllCommonsvc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
52	raw.githubusercontent.com
54	raw.githubusercontent.com
14	raw.githubusercontent.com
33	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
51	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com
15	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\es-ES\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\5940a34987c991	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\es-ES\sppsvc.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\24dbde2999530e	DllCommonsvc.exe
File created	C:\Windows\de-DE\Registry.exe	DllCommonsvc.exe
File created	C:\Windows\de-DE\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Windows\TAPI\WmiPrvSE.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2884	schtasks.exe
1248	schtasks.exe
2256	schtasks.exe
2244	schtasks.exe
4292	schtasks.exe
4268	schtasks.exe
536	schtasks.exe
2312	schtasks.exe
1384	schtasks.exe
4812	schtasks.exe
980	schtasks.exe
4680	schtasks.exe
1924	schtasks.exe
3448	schtasks.exe
324	schtasks.exe
884	schtasks.exe
2432	schtasks.exe
1756	schtasks.exe
1740	schtasks.exe
4776	schtasks.exe
788	schtasks.exe
1836	schtasks.exe
2964	schtasks.exe
4568	schtasks.exe
4116	schtasks.exe
1404	schtasks.exe
924	schtasks.exe
3572	schtasks.exe
2772	schtasks.exe
4872	schtasks.exe
2240	schtasks.exe
4208	schtasks.exe
2664	schtasks.exe
4616	schtasks.exe
2368	schtasks.exe
4940	schtasks.exe
5112	schtasks.exe
4400	schtasks.exe
2380	schtasks.exe
5092	schtasks.exe
4228	schtasks.exe
2716	schtasks.exe
3312	schtasks.exe
2512	schtasks.exe
4796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
400	DllCommonsvc.exe
2092	powershell.exe
208	powershell.exe
4704	powershell.exe
4704	powershell.exe
2092	powershell.exe
208	powershell.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
2236	DllCommonsvc.exe
4628	powershell.exe
4628	powershell.exe
4024	powershell.exe
4024	powershell.exe
4288	powershell.exe
4288	powershell.exe
5052	powershell.exe
5052	powershell.exe
1504	powershell.exe
2516	powershell.exe
1504	powershell.exe
2516	powershell.exe
1144	powershell.exe
1144	powershell.exe
1264	powershell.exe
1264	powershell.exe
376	powershell.exe
376	powershell.exe
1588	powershell.exe
1588	powershell.exe
4328	powershell.exe
4328	powershell.exe
1652	powershell.exe
1652	powershell.exe
1592	powershell.exe
1592	powershell.exe
544	powershell.exe
544	powershell.exe
544	powershell.exe
5052	powershell.exe
4628	powershell.exe
2516	powershell.exe
4024	powershell.exe
1592	powershell.exe
4288	powershell.exe
1264	powershell.exe
376	powershell.exe
1504	powershell.exe
1144	powershell.exe
4328	powershell.exe
1588	powershell.exe
1652	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	DllCommonsvc.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	2236	DllCommonsvc.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4812	DllCommonsvc.exe
Token: SeDebugPrivilege	4832	DllCommonsvc.exe
Token: SeDebugPrivilege	2548	DllCommonsvc.exe
Token: SeDebugPrivilege	2748	DllCommonsvc.exe
Token: SeDebugPrivilege	2024	DllCommonsvc.exe
Token: SeDebugPrivilege	2536	DllCommonsvc.exe
Token: SeDebugPrivilege	5060	DllCommonsvc.exe
Token: SeDebugPrivilege	4916	DllCommonsvc.exe
Token: SeDebugPrivilege	1196	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1144	5092	JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe	83
PID 5092 wrote to memory of 1144	5092	JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe	83
PID 5092 wrote to memory of 1144	5092	JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe	83
PID 1144 wrote to memory of 4880	1144	WScript.exe	85
PID 1144 wrote to memory of 4880	1144	WScript.exe	85
PID 1144 wrote to memory of 4880	1144	WScript.exe	85
PID 4880 wrote to memory of 400	4880	cmd.exe	87
PID 4880 wrote to memory of 400	4880	cmd.exe	87
PID 400 wrote to memory of 4704	400	DllCommonsvc.exe	96
PID 400 wrote to memory of 4704	400	DllCommonsvc.exe	96
PID 400 wrote to memory of 2092	400	DllCommonsvc.exe	97
PID 400 wrote to memory of 2092	400	DllCommonsvc.exe	97
PID 400 wrote to memory of 208	400	DllCommonsvc.exe	98
PID 400 wrote to memory of 208	400	DllCommonsvc.exe	98
PID 400 wrote to memory of 3700	400	DllCommonsvc.exe	102
PID 400 wrote to memory of 3700	400	DllCommonsvc.exe	102
PID 3700 wrote to memory of 3520	3700	cmd.exe	104
PID 3700 wrote to memory of 3520	3700	cmd.exe	104
PID 3700 wrote to memory of 2236	3700	cmd.exe	106
PID 3700 wrote to memory of 2236	3700	cmd.exe	106
PID 2236 wrote to memory of 5052	2236	DllCommonsvc.exe	146
PID 2236 wrote to memory of 5052	2236	DllCommonsvc.exe	146
PID 2236 wrote to memory of 4024	2236	DllCommonsvc.exe	147
PID 2236 wrote to memory of 4024	2236	DllCommonsvc.exe	147
PID 2236 wrote to memory of 1592	2236	DllCommonsvc.exe	148
PID 2236 wrote to memory of 1592	2236	DllCommonsvc.exe	148
PID 2236 wrote to memory of 1144	2236	DllCommonsvc.exe	149
PID 2236 wrote to memory of 1144	2236	DllCommonsvc.exe	149
PID 2236 wrote to memory of 4328	2236	DllCommonsvc.exe	150
PID 2236 wrote to memory of 4328	2236	DllCommonsvc.exe	150
PID 2236 wrote to memory of 4288	2236	DllCommonsvc.exe	151
PID 2236 wrote to memory of 4288	2236	DllCommonsvc.exe	151
PID 2236 wrote to memory of 1652	2236	DllCommonsvc.exe	152
PID 2236 wrote to memory of 1652	2236	DllCommonsvc.exe	152
PID 2236 wrote to memory of 376	2236	DllCommonsvc.exe	153
PID 2236 wrote to memory of 376	2236	DllCommonsvc.exe	153
PID 2236 wrote to memory of 544	2236	DllCommonsvc.exe	154
PID 2236 wrote to memory of 544	2236	DllCommonsvc.exe	154
PID 2236 wrote to memory of 4628	2236	DllCommonsvc.exe	155
PID 2236 wrote to memory of 4628	2236	DllCommonsvc.exe	155
PID 2236 wrote to memory of 1504	2236	DllCommonsvc.exe	156
PID 2236 wrote to memory of 1504	2236	DllCommonsvc.exe	156
PID 2236 wrote to memory of 1588	2236	DllCommonsvc.exe	157
PID 2236 wrote to memory of 1588	2236	DllCommonsvc.exe	157
PID 2236 wrote to memory of 2516	2236	DllCommonsvc.exe	158
PID 2236 wrote to memory of 2516	2236	DllCommonsvc.exe	158
PID 2236 wrote to memory of 1264	2236	DllCommonsvc.exe	159
PID 2236 wrote to memory of 1264	2236	DllCommonsvc.exe	159
PID 2236 wrote to memory of 1100	2236	DllCommonsvc.exe	174
PID 2236 wrote to memory of 1100	2236	DllCommonsvc.exe	174
PID 1100 wrote to memory of 3744	1100	cmd.exe	176
PID 1100 wrote to memory of 3744	1100	cmd.exe	176
PID 1100 wrote to memory of 4812	1100	cmd.exe	178
PID 1100 wrote to memory of 4812	1100	cmd.exe	178
PID 4812 wrote to memory of 2436	4812	DllCommonsvc.exe	180
PID 4812 wrote to memory of 2436	4812	DllCommonsvc.exe	180
PID 2436 wrote to memory of 3064	2436	cmd.exe	182
PID 2436 wrote to memory of 3064	2436	cmd.exe	182
PID 2436 wrote to memory of 4832	2436	cmd.exe	184
PID 2436 wrote to memory of 4832	2436	cmd.exe	184
PID 4832 wrote to memory of 1084	4832	DllCommonsvc.exe	199
PID 4832 wrote to memory of 1084	4832	DllCommonsvc.exe	199
PID 1084 wrote to memory of 2984	1084	cmd.exe	201
PID 1084 wrote to memory of 2984	1084	cmd.exe	201

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66333438a52987f69dfdc9fa953a9526fc2809125f0ea52e67a57975efc5d683.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:208
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uAyOYkvM3A.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3700
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3520
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\WmiPrvSE.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\es-ES\sppsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\de-DE\Registry.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\DllCommonsvc.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A2cou9xIYA.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3744
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3064
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2984
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
        13⤵
        
        PID:1736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3084
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"
        15⤵
        
        PID:2144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4952
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat"
        17⤵
        
        PID:3624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2840
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat"
        19⤵
        
        PID:1724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3156
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        21⤵
        
        PID:1348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4328
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat"
        23⤵
        
        PID:1680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1496
        
        C:\Users\Public\AccountPictures\DllCommonsvc.exe
        
        "C:\Users\Public\AccountPictures\DllCommonsvc.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat"
        25⤵
        
        PID:3772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\TAPI\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\es-ES\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\es-ES\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
07ab6cc81c5230a598c0ad1711b6bd97

SHA1
de7e270e12d447dfc5896b7c96777eb32725778a

SHA256
900aa2c83ec8773c3f9705f75b28fff0eaca57f7adb33dc82564d7ea8f8069a3

SHA512
ffef0ad0824ea0fdab29eb3c44448100f79365a1729c7665eba9aef85a88e60901bc6a6c248de15a28d21be9ce5839d68861e4449ff557d8845927c740ba3a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96d012dd35ee43a23db987854cc9f3eb

SHA1
68fb6c90ec116b5464c1a1e7764fd17dc043bf5b

SHA256
7e35c3ce2380410d8c23b9475a5b9f0f9a9f43002638a41219e4e8023afd0ef2

SHA512
c487d1a9eb7b2290cdbfce6d81df3836d22877efc6fa6aa5357c59ae70f3b577ae7094e69bb589d207f7657c2110a65b669880922c56817c055e5addad0daee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f6b5bbcd2386512d0b9af775e45d3770

SHA1
a3f6c4f46c10ce9d9b7d8a0a7b8a922dbbdd3d43

SHA256
50adabd48c94301dd4c4338e23583a702f7626abf793e6ae2eb919a18c8db999

SHA512
3775a27e3ad5a6149b88214f8bc6e45335e02af4589468ca8c140db758f152a59adf3c56361523b09c6ac2b316bd6c66886f9755a1823fc2c4468a1fad417add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fdf15f7d08f3f7538ae67e5b3e5d23f4

SHA1
953ff0529053ce3a1930b4f5abba2364a8befbfc

SHA256
9f4964b9cf2c6d4915a8f2b9746dc5ff73d6f327c81370f92e0e7a611b28a707

SHA512
4fee933635376d1467e0be63d12fa897f83cbbf9cdd1ac79cce30dfaa2621d47e137e991b701f1ed9910767904dbfb6b89db2a02ce32edc410c83351f351d7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7e289a3d34516b4e7de2611b6c12f0b2

SHA1
e8e03cc1bfdc8ba943a4b3d63096972fa17709a0

SHA256
0b4cbf3ad8768569a414f60e265701cdf7ebb2d2f5a32519d72604ead942f97f

SHA512
ce91056d04768defa621cbd08c03892a5861ee620fcb9ee5a376f9f884ebb8bff7f53f28c351093baca1f7be767a37ed4e52ee7dc77fa6d5b645001c05b47ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e8609c12c59293ee67562f5096525f6f

SHA1
7b89311e1e00dec0658daa7749b6560af217435c

SHA256
9e7a84df1f437f21ceba6e519fbbd333f0bd7721e8e4b0bb963652fb9a1163fa

SHA512
ce6838f441c0954739ec5e03af0726d20b892c4415df3c3ee2010bc6c8f6191ac6717d0e3499ce04a03441b1ad43fc7a2df0de34a1ebd67fbd62cfdf48007b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat

Filesize
213B

MD5
9aea2f93c3301b4e790189b35be040b0

SHA1
42fde8902f265f778489f4d69cf655a03b3c2544

SHA256
1f4305fb9f1544ae13e07ac00176fe31fe9649c43664a60238e7f773d79be3b5

SHA512
63cd01a5f9f00f8470c27f9666a35d1c73db724d40fdaa015f4858b8ccafb933f8ccad0cfd3529bfab9505fbb35b0ac934d32177f99f3d4243e368a947c3096c

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2cou9xIYA.bat

Filesize
213B

MD5
cd0c6ddf7b2e0cc8e8d81579d56e29ff

SHA1
a290165d804d390befe09732f8ff87a52fb71003

SHA256
4a6909192e8f6e7afeba21e78084cdaca4e1eb86627d80c06d2abe4fb80f88dd

SHA512
4e6c5ec060cd928c0b754effc041f191d505178216f3f9114e5be9bca3b65c9e8aa8a8bceacb4558961bdcb18d20a9f9892a202f055ad143c38e4e2322c454b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBiR4PpyYA.bat

Filesize
213B

MD5
a82148eceff96cf1708987b9c5a10962

SHA1
5d63dc15660047912fb77ac05ee7f5fa18ebcdec

SHA256
34c4e0df00ef3d5f54d087cc0ea0318bd1119be70dfa5f9532e33e901ea885b4

SHA512
5da94cf369d77ca6375ca2639679e895ee626793bd5d030fb3d57b9f6194d2b65d8f470d18f29b75232243ae9bfd32c503aa1e6b9e66b13f2f30daa16fcdd53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2aNa3Lme8.bat

Filesize
213B

MD5
d98bf2349d8c1e900a2ed7e541b44d7c

SHA1
0050aaf4aa77cefae4ade9e70f4c22273d55f4c6

SHA256
0fa5e98973b0737a9ee6a1ef6d976f411b0cb471dba27ca4f1297b086fc05ac4

SHA512
b8bdd8200f190a445beffd971519f59e5b7303760fec8a9c30cff534a5e7b5eb185a74b7d8e199c690cefe2d5813b49d534cd75f6937753a372a29bc340ca8cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
213B

MD5
4b6ff34012196b31b689143469165660

SHA1
1816f1e1459b29312d3f155a95906b750b79dc36

SHA256
ba864d22760ce3e0307f0ce8b7be4c356809fa6d44cb7f12ea030c832a97f92b

SHA512
7d700abba3d57a4507d56c75dfbe46be954d4c34be90b21125edcc1ebe3d3b8ae69a408e4cf6db5c23a0641fa321803342ca637a8239b0a18b0683e7b9250acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat

Filesize
213B

MD5
b2cf125b4c5c657318fac5873501c01f

SHA1
78aa8327468b5372966894e694f2a07139b29e95

SHA256
cae25e74f947f0c945e9d87154997f8d3abc7be4ff523773221ae358b868c4b0

SHA512
353ccaea1fe782acf62404fc54af6308c137f573629bff6fe4a96913b479e087eec09c5d3aa9e8bf091ad3d4c730237dcdff5cfc5ae98888815ea8302db99583

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qohdybbf.al0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat

Filesize
213B

MD5
964dd7a7dd1d6b500dfd3636846f3ce7

SHA1
3ad75e856321621a6d345922ab30131db250837d

SHA256
8ef802d2d3a707fcc639944e4bee16eac114b86585c69a89308dbd443b0692f2

SHA512
fe005ce630429d058ec76a60d259dd69abac9c5b07d7ae5727fd7b6f39d48a1a9df46615e9886976d7048369ecaeafa40f1f09227facd44b63ca5b88666cc71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

Filesize
213B

MD5
bb51a2da9de4d06a764a2076b10e670d

SHA1
cc3afa833077e9c43deddc145e2cb418e4cf0b92

SHA256
24f456d4f36d486eae0f8f4e230a9684bfabcd8ddf6d2f58fe140f3b1046a7ab

SHA512
8acb9ac08142ca10e484aaaee4392f333fa5568c22827b30c818c9a510372ab567566247a77275cac5253ed727063b6dab0667fbc689e8b93eae4f03b5be18bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat

Filesize
213B

MD5
0f333e9a1ca81eda47566f594696b3ad

SHA1
e50a89aa5596905313a192a5ed28edb18ff9b65d

SHA256
ee20fe38390cbc3d4e6938c05bda38f2165e559272cec5214bfcbef329ff36ba

SHA512
81a0905b161371dea5d44b6d0ea99a57846172b98293e26fa7e17a39309704e19c591557c243c97505bb794a455248caaf52f5c1b8f35b2499d44ed300d374b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\uAyOYkvM3A.bat

Filesize
199B

MD5
0a075c85901b152ba78c758f346e579e

SHA1
9211431086415e0d20027349f9b8760fec06b87a

SHA256
1682d9d62aad53534615f89c45efe0e999d10671db092f554667e99b150846de

SHA512
07f34e404b821fd3ef398a2b94d6523bc484ba8f9a78f8e6e354c2b790576e18ad716b3eae6b792535239c5263794a9a532bf46387ed15e473d92395b1b32aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat

Filesize
213B

MD5
473d7bb5d8b13bc51780898cd756dd01

SHA1
a1ede9b6770a2c018e0cbbd0bcdb02c0507c74d0

SHA256
ac108850be8868cd1efe3926efd7fd988590afa232e50aadc062cf3851f93681

SHA512
1db3ffffd2e3ad051c44a9dd5aa1c193538060d6594c789d441c7c15dfce800003c3356aa70e99e0805c6f09afef72dfcb89495d62ffbacaffcef82f9bbcefb6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/400-15-0x000000001B390000-0x000000001B39C000-memory.dmp

Filesize
48KB

Download
memory/400-14-0x000000001B370000-0x000000001B382000-memory.dmp

Filesize
72KB

Download
memory/400-16-0x000000001B380000-0x000000001B38C000-memory.dmp

Filesize
48KB

Download
memory/400-13-0x0000000000760000-0x0000000000870000-memory.dmp

Filesize
1.1MB

Download
memory/400-12-0x00007FFEC90D3000-0x00007FFEC90D5000-memory.dmp

Filesize
8KB

Download
memory/400-17-0x000000001B3A0000-0x000000001B3AC000-memory.dmp

Filesize
48KB

Download
memory/1196-300-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/1196-305-0x000000001C390000-0x000000001C539000-memory.dmp

Filesize
1.7MB

Download
memory/2024-274-0x00000000027C0000-0x00000000027D2000-memory.dmp

Filesize
72KB

Download
memory/2092-27-0x0000028BA30A0000-0x0000028BA30C2000-memory.dmp

Filesize
136KB

Download
memory/2748-267-0x0000000002CE0000-0x0000000002CF2000-memory.dmp

Filesize
72KB

Download
memory/5060-291-0x000000001CB50000-0x000000001CCF9000-memory.dmp

Filesize
1.7MB

Download