dcrat | e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
Size

1.3MB
MD5

ff93deacee9f31af19efda4595731582
SHA1

ba6d683976b798f81282262ffec4246375938c22
SHA256

e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e
SHA512

0d4d8c937b432e8667a9d0e5c0f8f2dd6c2c273ae3b1100914cfeeb09034662f52200aeaa1c30d3f02c33b3ef55691d8c1f2ffbd1487a9f482f202d15d159e3c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2068	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2068	schtasks.exe	34

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000016d69-9.dat	dcrat
behavioral1/memory/536-13-0x0000000000A50000-0x0000000000B60000-memory.dmp	dcrat
behavioral1/memory/1476-128-0x0000000000990000-0x0000000000AA0000-memory.dmp	dcrat
behavioral1/memory/968-138-0x0000000000D90000-0x0000000000EA0000-memory.dmp	dcrat
behavioral1/memory/2836-197-0x0000000000C60000-0x0000000000D70000-memory.dmp	dcrat
behavioral1/memory/548-258-0x00000000012A0000-0x00000000013B0000-memory.dmp	dcrat
behavioral1/memory/2248-378-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat
behavioral1/memory/2824-439-0x0000000001060000-0x0000000001170000-memory.dmp	dcrat
behavioral1/memory/2756-500-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat
behavioral1/memory/1952-560-0x0000000000070000-0x0000000000180000-memory.dmp	dcrat
behavioral1/memory/568-620-0x0000000000E80000-0x0000000000F90000-memory.dmp	dcrat
behavioral1/memory/2884-680-0x0000000000350000-0x0000000000460000-memory.dmp	dcrat
behavioral1/memory/2296-740-0x0000000000080000-0x0000000000190000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1464	powershell.exe
892	powershell.exe
2152	powershell.exe
972	powershell.exe
1956	powershell.exe
304	powershell.exe
1852	powershell.exe
1360	powershell.exe
2272	powershell.exe
1204	powershell.exe
1544	powershell.exe
2500	powershell.exe
1436	powershell.exe
760	powershell.exe
3036	powershell.exe
1476	powershell.exe
2264	powershell.exe
2216	powershell.exe
2548	powershell.exe

Executes dropped EXE 24 IoCs

pid	Process
536	DllCommonsvc.exe
1972	DllCommonsvc.exe
1476	powershell.exe
1436	powershell.exe
892	powershell.exe
304	powershell.exe
1852	powershell.exe
2500	powershell.exe
1464	powershell.exe
1204	powershell.exe
760	powershell.exe
1544	powershell.exe
3036	powershell.exe
968	conhost.exe
2836	powershell.exe
548	powershell.exe
1040	powershell.exe
2248	powershell.exe
2824	powershell.exe
2756	powershell.exe
1952	powershell.exe
568	powershell.exe
2884	powershell.exe
2296	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
2604	cmd.exe
2604	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
18	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
21	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
32	raw.githubusercontent.com
35	raw.githubusercontent.com
39	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\e978f868350d50	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\088424020bedd6	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\audiodg.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Common Files\Services\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\powershell.exe	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\886983d96e3d3e	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3032	schtasks.exe
2820	schtasks.exe
2928	schtasks.exe
2868	schtasks.exe
580	schtasks.exe
624	schtasks.exe
2368	schtasks.exe
2912	schtasks.exe
2744	schtasks.exe
2932	schtasks.exe
2836	schtasks.exe
784	schtasks.exe
1196	schtasks.exe
2712	schtasks.exe
2124	schtasks.exe
2628	schtasks.exe
2588	schtasks.exe
600	schtasks.exe
448	schtasks.exe
3044	schtasks.exe
1232	schtasks.exe
2764	schtasks.exe
2832	schtasks.exe
3028	schtasks.exe
1008	schtasks.exe
2556	schtasks.exe
784	schtasks.exe
1636	schtasks.exe
2756	schtasks.exe
2384	schtasks.exe
292	schtasks.exe
2664	schtasks.exe
3008	schtasks.exe
2244	schtasks.exe
1968	schtasks.exe
2664	schtasks.exe
3016	schtasks.exe
1036	schtasks.exe
1356	schtasks.exe
2156	schtasks.exe
2532	schtasks.exe
2372	schtasks.exe
1864	schtasks.exe
3024	schtasks.exe
2952	schtasks.exe
2880	schtasks.exe
2876	schtasks.exe
2804	schtasks.exe
1072	schtasks.exe
2372	schtasks.exe
3020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
536	DllCommonsvc.exe
2216	powershell.exe
1360	powershell.exe
2152	powershell.exe
2548	powershell.exe
1956	powershell.exe
972	powershell.exe
2264	powershell.exe
2272	powershell.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1972	DllCommonsvc.exe
1476	powershell.exe
2836	powershell.exe
548	powershell.exe
1040	powershell.exe
2248	powershell.exe
2824	powershell.exe
2756	powershell.exe
1952	powershell.exe
568	powershell.exe
2884	powershell.exe
2296	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	DllCommonsvc.exe
Token: SeDebugPrivilege	1972	DllCommonsvc.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	304	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	968	conhost.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2268	2792	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	30
PID 2792 wrote to memory of 2268	2792	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	30
PID 2792 wrote to memory of 2268	2792	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	30
PID 2792 wrote to memory of 2268	2792	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	30
PID 2268 wrote to memory of 2604	2268	WScript.exe	31
PID 2268 wrote to memory of 2604	2268	WScript.exe	31
PID 2268 wrote to memory of 2604	2268	WScript.exe	31
PID 2268 wrote to memory of 2604	2268	WScript.exe	31
PID 2604 wrote to memory of 536	2604	cmd.exe	33
PID 2604 wrote to memory of 536	2604	cmd.exe	33
PID 2604 wrote to memory of 536	2604	cmd.exe	33
PID 2604 wrote to memory of 536	2604	cmd.exe	33
PID 536 wrote to memory of 1360	536	DllCommonsvc.exe	56
PID 536 wrote to memory of 1360	536	DllCommonsvc.exe	56
PID 536 wrote to memory of 1360	536	DllCommonsvc.exe	56
PID 536 wrote to memory of 2152	536	DllCommonsvc.exe	57
PID 536 wrote to memory of 2152	536	DllCommonsvc.exe	57
PID 536 wrote to memory of 2152	536	DllCommonsvc.exe	57
PID 536 wrote to memory of 2272	536	DllCommonsvc.exe	58
PID 536 wrote to memory of 2272	536	DllCommonsvc.exe	58
PID 536 wrote to memory of 2272	536	DllCommonsvc.exe	58
PID 536 wrote to memory of 2264	536	DllCommonsvc.exe	60
PID 536 wrote to memory of 2264	536	DllCommonsvc.exe	60
PID 536 wrote to memory of 2264	536	DllCommonsvc.exe	60
PID 536 wrote to memory of 2548	536	DllCommonsvc.exe	61
PID 536 wrote to memory of 2548	536	DllCommonsvc.exe	61
PID 536 wrote to memory of 2548	536	DllCommonsvc.exe	61
PID 536 wrote to memory of 1956	536	DllCommonsvc.exe	62
PID 536 wrote to memory of 1956	536	DllCommonsvc.exe	62
PID 536 wrote to memory of 1956	536	DllCommonsvc.exe	62
PID 536 wrote to memory of 972	536	DllCommonsvc.exe	63
PID 536 wrote to memory of 972	536	DllCommonsvc.exe	63
PID 536 wrote to memory of 972	536	DllCommonsvc.exe	63
PID 536 wrote to memory of 2216	536	DllCommonsvc.exe	64
PID 536 wrote to memory of 2216	536	DllCommonsvc.exe	64
PID 536 wrote to memory of 2216	536	DllCommonsvc.exe	64
PID 536 wrote to memory of 1972	536	DllCommonsvc.exe	72
PID 536 wrote to memory of 1972	536	DllCommonsvc.exe	72
PID 536 wrote to memory of 1972	536	DllCommonsvc.exe	72
PID 1972 wrote to memory of 1464	1972	DllCommonsvc.exe	103
PID 1972 wrote to memory of 1464	1972	DllCommonsvc.exe	103
PID 1972 wrote to memory of 1464	1972	DllCommonsvc.exe	103
PID 1972 wrote to memory of 1476	1972	DllCommonsvc.exe	104
PID 1972 wrote to memory of 1476	1972	DllCommonsvc.exe	104
PID 1972 wrote to memory of 1476	1972	DllCommonsvc.exe	104
PID 1972 wrote to memory of 2500	1972	DllCommonsvc.exe	105
PID 1972 wrote to memory of 2500	1972	DllCommonsvc.exe	105
PID 1972 wrote to memory of 2500	1972	DllCommonsvc.exe	105
PID 1972 wrote to memory of 892	1972	DllCommonsvc.exe	106
PID 1972 wrote to memory of 892	1972	DllCommonsvc.exe	106
PID 1972 wrote to memory of 892	1972	DllCommonsvc.exe	106
PID 1972 wrote to memory of 3036	1972	DllCommonsvc.exe	107
PID 1972 wrote to memory of 3036	1972	DllCommonsvc.exe	107
PID 1972 wrote to memory of 3036	1972	DllCommonsvc.exe	107
PID 1972 wrote to memory of 1852	1972	DllCommonsvc.exe	108
PID 1972 wrote to memory of 1852	1972	DllCommonsvc.exe	108
PID 1972 wrote to memory of 1852	1972	DllCommonsvc.exe	108
PID 1972 wrote to memory of 1544	1972	DllCommonsvc.exe	109
PID 1972 wrote to memory of 1544	1972	DllCommonsvc.exe	109
PID 1972 wrote to memory of 1544	1972	DllCommonsvc.exe	109
PID 1972 wrote to memory of 304	1972	DllCommonsvc.exe	110
PID 1972 wrote to memory of 304	1972	DllCommonsvc.exe	110
PID 1972 wrote to memory of 304	1972	DllCommonsvc.exe	110
PID 1972 wrote to memory of 760	1972	DllCommonsvc.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
"C:\Users\Admin\AppData\Local\Temp\e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1972
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QRlBHoY6P9.bat"
        7⤵
        
        PID:1480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2936
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat"
        9⤵
        
        PID:2824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:700
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat"
        11⤵
        
        PID:2696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2556
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat"
        13⤵
        
        PID:1780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2676
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J91AFVPMIK.bat"
        15⤵
        
        PID:2204
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2464
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
        17⤵
        
        PID:1784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3036
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"
        19⤵
        
        PID:2968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1940
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat"
        21⤵
        
        PID:1232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1660
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dFeEewS5jL.bat"
        23⤵
        
        PID:1540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1624
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat"
        25⤵
        
        PID:1088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2868
        
        C:\providercommon\powershell.exe
        
        "C:\providercommon\powershell.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat"
        27⤵
        
        PID:1132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1192
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Videos\services.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:304
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
      - C:\providercommon\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\My Videos\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A6z4DAcL8j.bat"
        6⤵
        
        PID:1520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2036
        
        C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe
        
        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\providercommon\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\providercommon\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\providercommon\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jdk1.7.0_80\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Videos\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Videos\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\providercommon\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\providercommon\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Documents\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Documents\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Documents\My Videos\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Admin\Documents\My Videos\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Documents\My Videos\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a5a0e52f4b1ac79d5ee952742b4dd81

SHA1
c1031fb4fd0f951ec4fa21a742f8196d4db03853

SHA256
74085c20d8bccf185487f69a842c19af5336f1cb4a079dccb4631b04ca300eb3

SHA512
024fb70e9f9107ba6dbff67421972ae68c56a3e882d4016dcb880efcc61b4a4414e4ebc1c773dd682c0294e7c0aa20db7d1ee1984f2ef1ac8b5ba0de62947afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb9f84d2675067e5bca36ffa53de2780

SHA1
b16873383c225ff3144a0cfa63b130ecf70b0191

SHA256
ecf7d2ff160cf07e558dd4b42c9c99b5217574122f850d8042e0c73e32a7ba28

SHA512
af58d9741776f584921b1ced3341d542c625cd549ca446fe495b6867cf90b8cc814c2261e0032a29888fb0612fbac144263b784bd0b33b74d7ebc0b57658a418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af3ad5c3a31182c499e7e7097937c1f1

SHA1
732519e988f75d3a8fcd8d4e83ccf00130c3f873

SHA256
3446eab6c38fa9e7b07cb22c25244be683e2895ef897d4101cf1078f0c54e641

SHA512
34685a80490079c3e43d1b0df12c9751bbfd806c8d8ce93f113f9559fdd5bdba3c786231a9d2f61a7f641857c75f9ede4f72c4e2c519f65a713799b152fae280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccaee8c27858873dea39e7a29086515

SHA1
ee2857c73323655726134cb6db5e786a850d99e3

SHA256
5eb29f8469877d303a85ee2f2aa8c25a278e12e518f704b9b39329f36c1f3a97

SHA512
f507c9477552a134549258038be825f1bb7165a85492d538f16d78fd98fb3d9a9a6abf541666c04897b67bcaff9afbc74e2abccb20a3d506904ec946b8c32673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7d27adfd5306ac4163aada97ee199a2

SHA1
ea2162a752710e22b96de5834706a4edbdbb9934

SHA256
75ff856d6f1c057ef079beb6a763fd6d6d633d17bc51ff18a471c930cca933eb

SHA512
ef492153dc650848b2aa45ebfb9d1deb55b351c242eb486bad9e81cd27fee19b912b1f65b9c805b61258430cdba9a48b5636467b4d9c4ff6979a0bf29cf94d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38a2183a60e2e9112b80a75a15678029

SHA1
05b99c8da472dc7d5269aa21a66bb4ee4f0dd651

SHA256
b4e85d5f3e33b1c87aab294415ae5666dc2a7b5726d740bf1199f6964110175f

SHA512
f6010ac43a15deb379e7051d34380505c7de7a3289209a7404c1d2c9d22c8798219afe3b1bf4f1905914d3fcee515ab7b167889904d6f97ab69fe67266fcc7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297237917e1b35fde467ec630db45899

SHA1
ae80102f97dd3905738f5875979d50ae08233ca9

SHA256
a6ad7d9580feb25a39655c3ebae2a71aa47291f0729a529a8c1468d83ac3683f

SHA512
34c1a2e6f45b39e3588fab28c3855086d39393ed45224ac750ca565ce69328ba9b13dc9c4b1c511b5dcb6d89d55db8ac92b9a7a7c688fe1a2e6626c7b11e6e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5438f061b069c2d44508108797108f83

SHA1
0dfd8959e958630ebbba75b40727b90f5ad1e211

SHA256
c9319d251edb61dd2343693caf671732889ac59f7cbd0e535a91ace72ad342a7

SHA512
e90316cd48cc6c37f6554d9b825e45bc1e962e8e62fc54d2088601abf169dbb426645d6cb9b84bf9dcf2e1bde0957866a1a37493bc222c9e500472370d632fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffc5f2f7883b40c2cb5f45475e5c96d9

SHA1
32407276a61d8d2987c6de9cdab42a52e1463b4b

SHA256
57b0f05a313a2d7e189771a66199fedef236e606b10154d209129dac204a53c6

SHA512
de61cdab569643e7834a2833a8bcbd6cb34049f6390e9dac1831a99042a8b691b993cd9b4da4da730123a05ab19f92c4a8a426616679a5c449bedcc7887685ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6edec90980b47c8786cc012d05ee445a

SHA1
208ea97f4afb674ae30ca18b8de4a708743f5565

SHA256
666e13956559c7ee607823874d7037761a2f95e1141a6b695a46115b4f945792

SHA512
0630915b5af092cd1ecfb07379a6e1a7587b51ee6f7564ec5c84f01e17ee284f99510260063200ac6482c5395c1dafd224f2f8b00b67002c6ffa278499e19483

Download Submit
C:\Users\Admin\AppData\Local\Temp\0LMDaVm4bI.bat

Filesize
197B

MD5
ffe183cda71da4474eb2a2cd08f08958

SHA1
95ad2a6adb9020a5e04f411d14f46ee652df547c

SHA256
73565f697cdca9f201670c862a18a28d16f5622cb60980d6fbeaf73b2e449402

SHA512
5cfdb0432fdda6b038a40d2b6b54f5528f69340ab34f019fd43015b0746ba53d5fee21add3b545377b3eb46e0f1d5426138f13b75c118904f9efeabce9a8904b

Download Submit
C:\Users\Admin\AppData\Local\Temp\A6z4DAcL8j.bat

Filesize
240B

MD5
d299fe63f5871dcd2be7b83f898185aa

SHA1
d85f2d59391ba9593949d3f17d1424396c5f4fe5

SHA256
8cd72ffb324f7e3a5e9ea7782b555470ffb387b557c36c4ff749f0cae9e9b242

SHA512
0b9968e056584ebddb483f0400e25e113f55a6ad864df0667536b38b4478e2742d87ca84bb6dbc4394e0061387dfcf233b22f287356329a95fee5a305843e61e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAED7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrNnSCw4rJ.bat

Filesize
197B

MD5
0ea1d917799b18008780eb9758bc8042

SHA1
b47d5ae6053a625b418a08a04df539b8f7b643ab

SHA256
979a6ad36083f6e6849219e677bfe24dbda06ee5f5c211311175a7426984b9a8

SHA512
6677b680d31eee412810e38400430e7d5ffd212600b43c68da6c4082980c0cf84e8644e065ffe2fe0b27387b59feabc533c5e5c9c9b38eed5b101b24b8a20c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\J91AFVPMIK.bat

Filesize
197B

MD5
a60e9603fe78d5a5149060628aeb79d6

SHA1
658570d407915782f9cb61d739b9d8c0e1e41ba6

SHA256
41b94361c735c5dda03bac9f6f856d299ac75386dbf38a9891d6030032333722

SHA512
e9e6cb8987f1228d5fbc84f0a1a4721e8e547e97694476e93c47865b190263f17938c661b3b17f2379dbb493cdeef2426e9f11fcb49dd16d7eb067662f6a9b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat

Filesize
197B

MD5
26970d34dc357ed6b3eef035263a6ea9

SHA1
e00a1a28cb1444b4b2dc3beb1e9a4a5aafd00bd5

SHA256
b21bc2a81eea467c9af110b19f012ceaf5bac5d73ccc6ebd5ccbcda38d00a496

SHA512
1b02905e28a6d8eb9a1c1884cf098f838266d5c80a39d6457d46842279a231c4db80f15358b43d0d52cbf97445ee6281d1476b4bcee6c03481280ebcc27a13fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pkopelt31u.bat

Filesize
197B

MD5
2bc9f5e7557d915e5e7d3a0f456f3e3d

SHA1
77cf7e6757467fd206f90d4b8381c6a57d509efa

SHA256
57333290900a8174ffb401f9ce43f6ed19e947d4e0a9c80cc97e250ffae5a388

SHA512
83a019fd4a0ddd30ba268bde57bc6f3815022aba2ed2f38176fdefa1b26ea634fe16adfbdadd3fedee3a57b8e8b30cbd1f85a9a3b11c8039a042391de7e05f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\QRlBHoY6P9.bat

Filesize
197B

MD5
e8382008ea0d0f807a7513c906d65724

SHA1
455724624cc6bc57071040c2f0d062631ec79aac

SHA256
39a81f6a1ead01fd149afac87d9863e0ec5215f7fc8f38cbb1d05f02fcd1f8ff

SHA512
674883e7af87e3b757a9f327aee334bac0a7fb823a65048cea03b101e65842bef11d4648ab6eedf54efa9c3a5b7a3dd5ef603514adb2eb16c818bca43625e15c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAEEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat

Filesize
197B

MD5
b8bef0b3f5d2d90b72b941896faef819

SHA1
683478877bfd2816f831d25c39eee3c67bbf2718

SHA256
55b2e731cb5bf991b6e41ef3b04fc147d2074262efc1cd26f9b1d5cefb108f1e

SHA512
63a92e2d515c8d7e83375a5799e6eeff700c5f4c8c173a006bfcd568d79084e2b25ec0438059202e6046c637425af423ae429888730c7b3eab7dbd1a09b40700

Download Submit
C:\Users\Admin\AppData\Local\Temp\dFeEewS5jL.bat

Filesize
197B

MD5
6392991d63a9d8bbd846b032faa96a9d

SHA1
c912b9f46bb538f693e8c405a58fd013a52b83ad

SHA256
0ab665109a2df6c3939964f781629625718379d162995d91e94423d758f79559

SHA512
041fc5a535508a94917bf52473a2684bddc89a5aca9c96b597e188e851ee1ae853196783887b4768f5c0fd81b192da54c3f94b39faca6a6738bf12c8d0169bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jaxwQXfGLd.bat

Filesize
197B

MD5
5c7d1e6d47992784215bf53ffb51bf35

SHA1
7a30ca94315306001ce684826edec32a45755b46

SHA256
072b9267922027f59e5df93903bc04258400d474ecafdfd520dd971f488eca99

SHA512
5de128e8452f8aaa423e68778b5f22fc29cb14dbdc782490dcc5ed0804398f36bd97fffb5c26a8355a6213d0f6e92db186b3e55fa33bfe21ea670f63056f7a7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nGcIoKmMem.bat

Filesize
197B

MD5
47624a10118af2393a77cc0bffd15126

SHA1
e3db09f19c358b3ef8215619a8cacbbe09f2aa86

SHA256
ae45a40ae3c45ebccc7ab49229506b4a181c0354777fec6beca99f4c89bf0fbd

SHA512
f3e2f36d4aab75961cced14a811232af233898a0b7f73466d0a173983cd726eafd224c2961536f62d29fbd5fa825b0c4077c09f29efe8cc86b5a08abdd884c53

Download Submit
C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat

Filesize
197B

MD5
bbef76baf75c6e40c811944ecf8c81f0

SHA1
e8bd9bb70713125abe6d1ecb3ee724eae118fd42

SHA256
2a2ad01ee4010fce82282dd2a56ce43b4d81e435346558d97dd2771e3143bbe5

SHA512
b3c37fe097064fb49f34b6448677026429d1bdcb65c4b6be19c49d8ee7b992bba161926c2a9afbeef3c7469d6a0ddf8aade979d9846d41f93c5fd285a7d77860

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2703cba7b6caa7e933f8a76aff3e7e65

SHA1
9c8f6c34753560f562e74e180228242cc3208d4a

SHA256
c92fb427db631ff70b31ed68af06d853997a1a40fb79e9bec956227ad8920c34

SHA512
abf74c4d0b92045055d79f6ea747a4b28bd55b4b286bf3ffed65c66d9b3eea829de96bc2330b96e8578cabb3c3c80f8a8584c36a2a0fd92ef7e9e195e70acb16

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/536-13-0x0000000000A50000-0x0000000000B60000-memory.dmp

Filesize
1.1MB

Download
memory/536-14-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/536-15-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/536-16-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/536-17-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/548-258-0x00000000012A0000-0x00000000013B0000-memory.dmp

Filesize
1.1MB

Download
memory/568-620-0x0000000000E80000-0x0000000000F90000-memory.dmp

Filesize
1.1MB

Download
memory/968-138-0x0000000000D90000-0x0000000000EA0000-memory.dmp

Filesize
1.1MB

Download
memory/1040-318-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/1476-128-0x0000000000990000-0x0000000000AA0000-memory.dmp

Filesize
1.1MB

Download
memory/1952-560-0x0000000000070000-0x0000000000180000-memory.dmp

Filesize
1.1MB

Download
memory/2216-58-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2248-379-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2248-378-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2296-740-0x0000000000080000-0x0000000000190000-memory.dmp

Filesize
1.1MB

Download
memory/2548-57-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2756-500-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/2824-439-0x0000000001060000-0x0000000001170000-memory.dmp

Filesize
1.1MB

Download
memory/2824-440-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/2836-197-0x0000000000C60000-0x0000000000D70000-memory.dmp

Filesize
1.1MB

Download
memory/2836-198-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2884-680-0x0000000000350000-0x0000000000460000-memory.dmp

Filesize
1.1MB

Download