dcrat | 1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe
Size

1.3MB
MD5

b4b17f1c8d833559852e774cd6b27e14
SHA1

9964dac3b9de809d24e8800c1304bb8f1e95f870
SHA256

1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a
SHA512

a37092e1d2615a1e0f6d29953ffd55f72b18bf0a20cc089a4d691415f65f546bf93169e997f89932c90a0d5a783ae0f281f45569e67cbc1f4362f0a146f64c86
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2644	schtasks.exe	35

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000018bf3-9.dat	dcrat
behavioral1/memory/2216-13-0x0000000000B60000-0x0000000000C70000-memory.dmp	dcrat
behavioral1/memory/776-157-0x0000000000120000-0x0000000000230000-memory.dmp	dcrat
behavioral1/memory/2344-217-0x0000000000FD0000-0x00000000010E0000-memory.dmp	dcrat
behavioral1/memory/2796-514-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat
behavioral1/memory/2316-576-0x0000000001020000-0x0000000001130000-memory.dmp	dcrat
behavioral1/memory/2492-636-0x00000000002A0000-0x00000000003B0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
2860	powershell.exe
2868	powershell.exe
2792	powershell.exe
2660	powershell.exe
2440	powershell.exe
2656	powershell.exe
2444	powershell.exe
2836	powershell.exe
2560	powershell.exe
2584	powershell.exe
1640	powershell.exe
1876	powershell.exe
2692	powershell.exe
2672	powershell.exe
2528	powershell.exe
2264	powershell.exe
708	powershell.exe
2648	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2216	DllCommonsvc.exe
776	taskhost.exe
2344	taskhost.exe
2788	taskhost.exe
2060	taskhost.exe
3032	taskhost.exe
2748	taskhost.exe
2796	taskhost.exe
2252	taskhost.exe
2316	taskhost.exe
2492	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
1860	cmd.exe
1860	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
12	raw.githubusercontent.com
34	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
16	raw.githubusercontent.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com
24	raw.githubusercontent.com
38	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\b75386f1303e64	DllCommonsvc.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\56085415360792	DllCommonsvc.exe
File created	C:\Windows\Branding\ShellBrd\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\Offline Web Pages\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\fr-FR\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\AppPatch\de-DE\services.exe	DllCommonsvc.exe
File created	C:\Windows\AppPatch\de-DE\c5b4cb5e9653cc	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Web\Wallpaper\Nature\sppsvc.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\Prefetch\ReadyBoot\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\fr-FR\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\Web\Wallpaper\Nature\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Windows\Branding\ShellBrd\886983d96e3d3e	DllCommonsvc.exe
File opened for modification	C:\Windows\Web\Wallpaper\Nature\sppsvc.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2704	schtasks.exe
1152	schtasks.exe
2412	schtasks.exe
2092	schtasks.exe
2140	schtasks.exe
1972	schtasks.exe
1248	schtasks.exe
852	schtasks.exe
2908	schtasks.exe
1560	schtasks.exe
1692	schtasks.exe
2392	schtasks.exe
344	schtasks.exe
1520	schtasks.exe
2892	schtasks.exe
2180	schtasks.exe
2060	schtasks.exe
2624	schtasks.exe
304	schtasks.exe
1720	schtasks.exe
1036	schtasks.exe
1536	schtasks.exe
2436	schtasks.exe
2592	schtasks.exe
3012	schtasks.exe
2952	schtasks.exe
408	schtasks.exe
2844	schtasks.exe
1592	schtasks.exe
1040	schtasks.exe
1988	schtasks.exe
2388	schtasks.exe
776	schtasks.exe
2588	schtasks.exe
3024	schtasks.exe
2064	schtasks.exe
1996	schtasks.exe
1360	schtasks.exe
3028	schtasks.exe
1664	schtasks.exe
1304	schtasks.exe
288	schtasks.exe
2268	schtasks.exe
2748	schtasks.exe
2240	schtasks.exe
2520	schtasks.exe
2860	schtasks.exe
2036	schtasks.exe
1936	schtasks.exe
960	schtasks.exe
2200	schtasks.exe
716	schtasks.exe
1892	schtasks.exe
380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2216	DllCommonsvc.exe
2792	powershell.exe
708	powershell.exe
2868	powershell.exe
2692	powershell.exe
2656	powershell.exe
2560	powershell.exe
2528	powershell.exe
1128	powershell.exe
2648	powershell.exe
2264	powershell.exe
2660	powershell.exe
2672	powershell.exe
2444	powershell.exe
2860	powershell.exe
2836	powershell.exe
1876	powershell.exe
2584	powershell.exe
2440	powershell.exe
1640	powershell.exe
776	taskhost.exe
2344	taskhost.exe
2788	taskhost.exe
2060	taskhost.exe
3032	taskhost.exe
2748	taskhost.exe
2796	taskhost.exe
2316	taskhost.exe
2492	taskhost.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	DllCommonsvc.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	776	taskhost.exe
Token: SeDebugPrivilege	2344	taskhost.exe
Token: SeDebugPrivilege	2788	taskhost.exe
Token: SeDebugPrivilege	2060	taskhost.exe
Token: SeDebugPrivilege	3032	taskhost.exe
Token: SeDebugPrivilege	2748	taskhost.exe
Token: SeDebugPrivilege	2796	taskhost.exe
Token: SeDebugPrivilege	2316	taskhost.exe
Token: SeDebugPrivilege	2492	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2076	3000	1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe	30
PID 3000 wrote to memory of 2076	3000	1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe	30
PID 3000 wrote to memory of 2076	3000	1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe	30
PID 3000 wrote to memory of 2076	3000	1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe	30
PID 2076 wrote to memory of 1860	2076	WScript.exe	31
PID 2076 wrote to memory of 1860	2076	WScript.exe	31
PID 2076 wrote to memory of 1860	2076	WScript.exe	31
PID 2076 wrote to memory of 1860	2076	WScript.exe	31
PID 1860 wrote to memory of 2216	1860	cmd.exe	34
PID 1860 wrote to memory of 2216	1860	cmd.exe	34
PID 1860 wrote to memory of 2216	1860	cmd.exe	34
PID 1860 wrote to memory of 2216	1860	cmd.exe	34
PID 2216 wrote to memory of 2792	2216	DllCommonsvc.exe	90
PID 2216 wrote to memory of 2792	2216	DllCommonsvc.exe	90
PID 2216 wrote to memory of 2792	2216	DllCommonsvc.exe	90
PID 2216 wrote to memory of 2692	2216	DllCommonsvc.exe	91
PID 2216 wrote to memory of 2692	2216	DllCommonsvc.exe	91
PID 2216 wrote to memory of 2692	2216	DllCommonsvc.exe	91
PID 2216 wrote to memory of 2660	2216	DllCommonsvc.exe	92
PID 2216 wrote to memory of 2660	2216	DllCommonsvc.exe	92
PID 2216 wrote to memory of 2660	2216	DllCommonsvc.exe	92
PID 2216 wrote to memory of 2836	2216	DllCommonsvc.exe	93
PID 2216 wrote to memory of 2836	2216	DllCommonsvc.exe	93
PID 2216 wrote to memory of 2836	2216	DllCommonsvc.exe	93
PID 2216 wrote to memory of 2560	2216	DllCommonsvc.exe	94
PID 2216 wrote to memory of 2560	2216	DllCommonsvc.exe	94
PID 2216 wrote to memory of 2560	2216	DllCommonsvc.exe	94
PID 2216 wrote to memory of 2440	2216	DllCommonsvc.exe	95
PID 2216 wrote to memory of 2440	2216	DllCommonsvc.exe	95
PID 2216 wrote to memory of 2440	2216	DllCommonsvc.exe	95
PID 2216 wrote to memory of 2672	2216	DllCommonsvc.exe	96
PID 2216 wrote to memory of 2672	2216	DllCommonsvc.exe	96
PID 2216 wrote to memory of 2672	2216	DllCommonsvc.exe	96
PID 2216 wrote to memory of 2648	2216	DllCommonsvc.exe	97
PID 2216 wrote to memory of 2648	2216	DllCommonsvc.exe	97
PID 2216 wrote to memory of 2648	2216	DllCommonsvc.exe	97
PID 2216 wrote to memory of 2528	2216	DllCommonsvc.exe	98
PID 2216 wrote to memory of 2528	2216	DllCommonsvc.exe	98
PID 2216 wrote to memory of 2528	2216	DllCommonsvc.exe	98
PID 2216 wrote to memory of 2656	2216	DllCommonsvc.exe	99
PID 2216 wrote to memory of 2656	2216	DllCommonsvc.exe	99
PID 2216 wrote to memory of 2656	2216	DllCommonsvc.exe	99
PID 2216 wrote to memory of 2444	2216	DllCommonsvc.exe	100
PID 2216 wrote to memory of 2444	2216	DllCommonsvc.exe	100
PID 2216 wrote to memory of 2444	2216	DllCommonsvc.exe	100
PID 2216 wrote to memory of 2584	2216	DllCommonsvc.exe	101
PID 2216 wrote to memory of 2584	2216	DllCommonsvc.exe	101
PID 2216 wrote to memory of 2584	2216	DllCommonsvc.exe	101
PID 2216 wrote to memory of 2264	2216	DllCommonsvc.exe	103
PID 2216 wrote to memory of 2264	2216	DllCommonsvc.exe	103
PID 2216 wrote to memory of 2264	2216	DllCommonsvc.exe	103
PID 2216 wrote to memory of 1128	2216	DllCommonsvc.exe	104
PID 2216 wrote to memory of 1128	2216	DllCommonsvc.exe	104
PID 2216 wrote to memory of 1128	2216	DllCommonsvc.exe	104
PID 2216 wrote to memory of 1876	2216	DllCommonsvc.exe	105
PID 2216 wrote to memory of 1876	2216	DllCommonsvc.exe	105
PID 2216 wrote to memory of 1876	2216	DllCommonsvc.exe	105
PID 2216 wrote to memory of 2868	2216	DllCommonsvc.exe	106
PID 2216 wrote to memory of 2868	2216	DllCommonsvc.exe	106
PID 2216 wrote to memory of 2868	2216	DllCommonsvc.exe	106
PID 2216 wrote to memory of 2860	2216	DllCommonsvc.exe	107
PID 2216 wrote to memory of 2860	2216	DllCommonsvc.exe	107
PID 2216 wrote to memory of 2860	2216	DllCommonsvc.exe	107
PID 2216 wrote to memory of 708	2216	DllCommonsvc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe
"C:\Users\Admin\AppData\Local\Temp\1b953f31d678378354ecab0d19fc9bd48bebe2e49e2058af83a3b7d1b048cd5a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\Wallpaper\Nature\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\ShellBrd\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\de-DE\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lrg0cjjkl6.bat"
        5⤵
        
        PID:1736
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1480
      - C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat"
        7⤵
        
        PID:900
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2892
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat"
        9⤵
        
        PID:2208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1844
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wYroxckjTC.bat"
        11⤵
        
        PID:1976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1568
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat"
        13⤵
        
        PID:1968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1364
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j2qd1ZwTnL.bat"
        15⤵
        
        PID:2004
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1620
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat"
        17⤵
        
        PID:2456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1568
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat"
        19⤵
        
        PID:2528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2432
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        20⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hfpeQ4JfvC.bat"
        21⤵
        
        PID:2308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2780
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tlxpltA24S.bat"
        23⤵
        
        PID:1840
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1844
        
        C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Wallpaper\Nature\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Nature\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Web\Wallpaper\Nature\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Branding\ShellBrd\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Branding\ShellBrd\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Branding\ShellBrd\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\fr-FR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\AppPatch\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppPatch\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\AppPatch\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\ServiceProfiles\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Recent\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Recent\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d201501c37f48252a26764ff74872945

SHA1
07b2ba2471dc444b7e652264ca778bc68fef423f

SHA256
17a7e3357f102f3bf7769813f2e174e216cc8d0fca8efa2bd92df76a821f4079

SHA512
1fbbf0040fa447637680aeb9f8c56419510fe5947f20d609978acf4b991a7c34d918f9f39a9becb809bad8de8b71192f5d0456e3de40068485b44cc27a2606e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c3a6b326fdca45d3e44bafa46304167

SHA1
6514a085f8701b54c2b5a5cca88d4d917bedaf05

SHA256
73fa47abb4a49d5693e6ca4c4ad3e41f74d52a4f4b3b8192cf0e44e3e36287a3

SHA512
d4beea239ca84850c0a715e84454d2418616cd9b273ad844eaa57dde7cdadf86446947d4b766a004ff3bff79d39a85fcf520e59579da18f55fee5977b428df9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab3cb10a6b536697888aa322c41f6f60

SHA1
67c3e5fbb75cde5058b3160587684783dfd13201

SHA256
75df53dedaddfd56d365db78e8af1571f7f2b5a0efb4a05a013aab0835ace478

SHA512
4e897b529bcab551e5ca23769fbda974328292ed0f7e53f32ae84789fdf83853f16f432ad25df7c4344d290fa42f5f75121924e413c22f1ea67d1c2fb935b04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59cf33def54d05107546d2cd978d9efd

SHA1
8ed2a8f6690cde6ea3f284bf3d08f7905a9c5d42

SHA256
d120e89b88e13fa80575dac7c9f31b5e4bdb1b73aa0123e1efa6d2bdb9843bff

SHA512
a22261fd5fcab2f889a1de671dcc83a9d120a554ddfbca3651551063bbb18f6e47dc76b7547362571b2d7ddeaba3b3386c0a09218d111c8dccb27d90d65caa27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ecef484238362337b36490709fec804

SHA1
c3b8c02b46e1aa2168bcf98bf9e7becce48edbc2

SHA256
c9063c47cf5ca783e768729d14f451b0e9d0d9126c407da6c5a28851d57ebbbd

SHA512
8af0ba78e393eba8580e3aaf54fa0d698a323ebf6c651892c73be99b7bfa9f3f33594829c8fc542fe67b840dc88cdc64871fa0aa859bf45e5233abbaac93d77c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a131e8a46b989864f35764f2489d9df

SHA1
b06b68bfd524bf438a0737f453499027f802bb64

SHA256
c65f1d496beb0f03aaebf0632650362c546ef7b0f595f04c4025e4db6901ee7f

SHA512
bd4ef502374df3610c996d1cc2dff419792840fda56765c01d05ce161368ae46917eb1ca54f2d80844bf9c3b0b5a727c4eda92da84e1e31fc32980e63a34b978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05c9558820239b64854dc7d505ce72a0

SHA1
8ed85161201c4198004e58e8288e42389cb91912

SHA256
6931eb8ae4dfea63bf6e2f1de0e439795fce5f4e5d774fedb71eabc0eba1a3aa

SHA512
3b6fb13f3d9c1379348a531d1c0d52889405d57e16297cd41b1059057b8c4c1fb7afdf9311fa4a844c50db6cbdee7f863755906e3ad3cf5e5a8f4e61c4bcfb5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01924edeff80a6d72e6dfd59ed9aedc2

SHA1
4928d675dcf91880b251328c51973d506767bafe

SHA256
026b3f51d857747ec4b501048ff56585204795bd46e40e70e697b7fd392baf8d

SHA512
f547018f09bf4862ba6c42c37473a02566e0303919e63fc90ef157e8fe5366fa36cf890228388417856eebfce3335c9a2bed86c61f399ead23c6f8cb35726807

Download Submit
C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat

Filesize
248B

MD5
6d8f32df5aabc439b04edefa2c5c5b48

SHA1
8bff0178181040671b6978bee258c8410c0c9e8a

SHA256
b00bba41fd392834c2f5b6b170c4179bed873781f1990cafd7c330d360d193c5

SHA512
37bb976dbad4deb5c797ad007b04a4c8f0524c9e648d5d94a1efd690156e5b1840982270265c33cdf268cbf488709860bbd37cd5fcdd21418b8818e5e1e4f4bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat

Filesize
248B

MD5
9a8c3a347c2154848dfd3d831bd51f3f

SHA1
b764134ca5128e7721acfd66cb0bd8dba3ffd656

SHA256
0621ebf43e1356b9b786c0eb7315bb4554b004ae78a4561e28b2535d728afdaf

SHA512
d9382c20f948d1fb290faa9ace290757027773e7530da75f0f77ce0efb01fc47d991d8173d0de87474423fb554f32a06aab6c3868d6d5e536deb4f93b1255ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1595.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPAAmIRCFx.bat

Filesize
248B

MD5
3427b373f9b831c168108cc813c01bd8

SHA1
d08970905972adbc00cf46c1b32857ff24b11491

SHA256
dfab73c6d45b5431b3475c41fdfccb2325d835be8df2489682852efa0714812e

SHA512
2b1cd5891de0ab96497974ac916279db0cad2132aa394c8a348055f1a0c7fe20d8968be0676c50f9aefdbc2da6492b987daf88dd9461900131760f94ab637807

Download Submit
C:\Users\Admin\AppData\Local\Temp\j2qd1ZwTnL.bat

Filesize
248B

MD5
bdd0f5255197dc63b57ea6a6f63719f9

SHA1
0050a4ca556b533470803278a25284c613787fec

SHA256
a6d4349be22bbf0b43274b2bee8f102e033a521f9f8cd5570a0ed290b44b6f35

SHA512
0e2d0179e28da149fddd054ce048ba0894f2af02ec766d5b0da463fe8b4337bb19a0b5fbbe47bf5b850a83108ba0dab9a7bb64e4f4e0b7b692e6f8e57dcf1db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lrg0cjjkl6.bat

Filesize
248B

MD5
dd6b8491009146e7a1aaaf061f8b9ac5

SHA1
ac3c8a4ba117471388d41abd4a01b1b5cbeaf774

SHA256
d82c76928ab146fd0b7ee5588c96b80310f41d0f76c72d4f035fad3f6febfca1

SHA512
0a5e8ecbf6ab2519f503451ef0103d7a4c583ff59f85e35910d76eb1cf368329763477211bb9ab18db0334a913d1377bec3ee345baf70b67bc29f8d0a2c96b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mNrvcGFykN.bat

Filesize
248B

MD5
1376c963974785f67bb43e6ac141e2a3

SHA1
c43e49f15fb757eb0175e32c35cdd6bc3c24e178

SHA256
2f587cb7553821ee28dcec4c492a64f55b9125cf942a27d947f24016d811efb5

SHA512
b380a2c1ba4598f175e7df1e88de16c9dca3809fd1c8a202efe80ce172195c7b17a831d27d2db52a7bd21feece1476333ac377b8677e5927d47cb967e77b5d28

Download Submit
C:\Users\Admin\AppData\Local\Temp\tlxpltA24S.bat

Filesize
248B

MD5
7257a34fa8cfc9ba7bf900ed398ae5e8

SHA1
9dd3f1b1137a350615510c8bd387ad162c2d89a6

SHA256
cf1c9c7d0449733ae3fadbc6781bbb5d58953d449ba48c2338e21184712ddea0

SHA512
8dc556ce2fc5eeacec5e304c1a9bee53c5e3cdc577f866a2601b39c2120f69f45c26cac445a68caa70763a4dda9d565f22fe51e5ba65d3445fa929e5708059be

Download Submit
C:\Users\Admin\AppData\Local\Temp\wYroxckjTC.bat

Filesize
248B

MD5
b20b667c7a424a1ba5b1f8262ea309ac

SHA1
20ea27bd1e2711041964491b6a2cc4eaf656c56e

SHA256
12dcf19d649f4ec5dd15deccfb3ef5aac1fbac6c0685d1a5be9c7b87df0c801a

SHA512
2b13fce4ca2be0ba5149d291a946b9966685264bbe49d2cebe4fe79f56be78367323a8a9a786b28b10c74ae839f42eddc0de600cf4e5a15fdc6a70c695a827dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\x5nMQhEI33.bat

Filesize
248B

MD5
a3ae3c10661f4058cc038c07c9361d22

SHA1
4acf22131d7ca265c5564bf69488db1cd09eaf80

SHA256
39529298d72fa47a2e527d381fd2f563f2760979113871034a97ba2cec119bab

SHA512
b21b6a3a0bc41dd30f31ca57aaf976242dbfff42aea2af59bfdcb71d55f928751f71bd469f19ab60d212b03c3cd6e69368973e8efaf2787c2a6a288b0a9f8ca9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EYYGOZ7YLOOKTESVJG01.temp

Filesize
7KB

MD5
173d47fe8953dd356b331bf1af0070ef

SHA1
815fcb4bf628f3ad10318bcaebc4311ee00dd0eb

SHA256
cca2dd9ab21a37053c9f93fa463e0a82b8d448d262742bf6bc89f828ec34877a

SHA512
efee84fdc8a5258a2c44739a687afdd8a47ad8721b1f6d2e95a600d2c136cd3fe530b9850cfccb0a4bffaecf792801e724f3771d791b3eb9d73ccd5ed23b321d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/776-158-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/776-157-0x0000000000120000-0x0000000000230000-memory.dmp

Filesize
1.1MB

Download
memory/2216-13-0x0000000000B60000-0x0000000000C70000-memory.dmp

Filesize
1.1MB

Download
memory/2216-15-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2216-14-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2216-17-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/2216-16-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2316-576-0x0000000001020000-0x0000000001130000-memory.dmp

Filesize
1.1MB

Download
memory/2344-217-0x0000000000FD0000-0x00000000010E0000-memory.dmp

Filesize
1.1MB

Download
memory/2492-636-0x00000000002A0000-0x00000000003B0000-memory.dmp

Filesize
1.1MB

Download
memory/2492-637-0x0000000000560000-0x0000000000572000-memory.dmp

Filesize
72KB

Download
memory/2788-277-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2792-68-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2792-69-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2796-514-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download