dcrat | 75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7

Analysis

max time kernel
147s
max time network
143s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe
Size

1.3MB
MD5

a872ad32daa1c1d80b2f31eefd0ef47e
SHA1

d48e5b59688873c32f81cd7ab51a5b1a47ceaa98
SHA256

75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7
SHA512

2fb15ab49207f705a5e543b394bb50221a2937a3f34e756093501cc669a026fa4432186abf6c3671a5842f57b0452859299b8f3c7dd7de90c2d15175548624a0
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2968	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2968	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000015d18-9.dat	dcrat
behavioral1/memory/1040-13-0x0000000000CF0000-0x0000000000E00000-memory.dmp	dcrat
behavioral1/memory/2560-152-0x0000000000EC0000-0x0000000000FD0000-memory.dmp	dcrat
behavioral1/memory/1260-211-0x0000000000040000-0x0000000000150000-memory.dmp	dcrat
behavioral1/memory/1952-271-0x0000000000DD0000-0x0000000000EE0000-memory.dmp	dcrat
behavioral1/memory/2064-331-0x00000000000F0000-0x0000000000200000-memory.dmp	dcrat
behavioral1/memory/1748-391-0x0000000001220000-0x0000000001330000-memory.dmp	dcrat
behavioral1/memory/2500-688-0x0000000000390000-0x00000000004A0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
576	powershell.exe
1564	powershell.exe
1984	powershell.exe
2964	powershell.exe
2068	powershell.exe
2292	powershell.exe
900	powershell.exe
1808	powershell.exe
884	powershell.exe
2892	powershell.exe
1288	powershell.exe
2352	powershell.exe
1052	powershell.exe
2012	powershell.exe
2136	powershell.exe
1988	powershell.exe
1432	powershell.exe
2372	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1040	DllCommonsvc.exe
2444	DllCommonsvc.exe
2560	WmiPrvSE.exe
1260	WmiPrvSE.exe
1952	WmiPrvSE.exe
2064	WmiPrvSE.exe
1748	WmiPrvSE.exe
1664	WmiPrvSE.exe
3056	WmiPrvSE.exe
2064	WmiPrvSE.exe
2536	WmiPrvSE.exe
2500	WmiPrvSE.exe

Loads dropped DLL 2 IoCs

pid	Process
2312	cmd.exe
2312	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
30	raw.githubusercontent.com
34	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
15	raw.githubusercontent.com
23	raw.githubusercontent.com
4	raw.githubusercontent.com
12	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\fr-FR\3a6fe29a7ceee6	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\es-ES\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\schtasks.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\fr-FR\schtasks.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\powershell.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\e978f868350d50	DllCommonsvc.exe
File opened for modification	C:\Program Files\Windows Journal\es-ES\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Journal\es-ES\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Games\6cb0b6c459d5d3	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
380	schtasks.exe
2972	schtasks.exe
1976	schtasks.exe
1624	schtasks.exe
1952	schtasks.exe
1816	schtasks.exe
408	schtasks.exe
292	schtasks.exe
1756	schtasks.exe
2568	schtasks.exe
2980	schtasks.exe
2308	schtasks.exe
2868	schtasks.exe
2480	schtasks.exe
2756	schtasks.exe
1948	schtasks.exe
2832	schtasks.exe
2952	schtasks.exe
2700	schtasks.exe
1692	schtasks.exe
1256	schtasks.exe
2908	schtasks.exe
676	schtasks.exe
1540	schtasks.exe
2332	schtasks.exe
2420	schtasks.exe
2044	schtasks.exe
2392	schtasks.exe
1804	schtasks.exe
2888	schtasks.exe
1336	schtasks.exe
2220	schtasks.exe
2768	schtasks.exe
1320	schtasks.exe
292	schtasks.exe
2236	schtasks.exe
1664	schtasks.exe
2484	schtasks.exe
1752	schtasks.exe
1540	schtasks.exe
2256	schtasks.exe
2288	schtasks.exe
768	schtasks.exe
2900	schtasks.exe
2804	schtasks.exe
2748	schtasks.exe
1520	schtasks.exe
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
1040	DllCommonsvc.exe
2068	powershell.exe
1984	powershell.exe
576	powershell.exe
2136	powershell.exe
1564	powershell.exe
1808	powershell.exe
884	powershell.exe
900	powershell.exe
2444	DllCommonsvc.exe
2012	powershell.exe
2292	powershell.exe
1052	powershell.exe
1988	powershell.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
2444	DllCommonsvc.exe
1432	powershell.exe
2892	powershell.exe
2964	powershell.exe
1288	powershell.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	DllCommonsvc.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2444	DllCommonsvc.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2560	WmiPrvSE.exe
Token: SeDebugPrivilege	1260	WmiPrvSE.exe
Token: SeDebugPrivilege	1952	WmiPrvSE.exe
Token: SeDebugPrivilege	2064	WmiPrvSE.exe
Token: SeDebugPrivilege	1748	WmiPrvSE.exe
Token: SeDebugPrivilege	1664	WmiPrvSE.exe
Token: SeDebugPrivilege	3056	WmiPrvSE.exe
Token: SeDebugPrivilege	2064	WmiPrvSE.exe
Token: SeDebugPrivilege	2536	WmiPrvSE.exe
Token: SeDebugPrivilege	2500	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2396	596	75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe	30
PID 596 wrote to memory of 2396	596	75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe	30
PID 596 wrote to memory of 2396	596	75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe	30
PID 596 wrote to memory of 2396	596	75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe	30
PID 2396 wrote to memory of 2312	2396	WScript.exe	31
PID 2396 wrote to memory of 2312	2396	WScript.exe	31
PID 2396 wrote to memory of 2312	2396	WScript.exe	31
PID 2396 wrote to memory of 2312	2396	WScript.exe	31
PID 2312 wrote to memory of 1040	2312	cmd.exe	33
PID 2312 wrote to memory of 1040	2312	cmd.exe	33
PID 2312 wrote to memory of 1040	2312	cmd.exe	33
PID 2312 wrote to memory of 1040	2312	cmd.exe	33
PID 1040 wrote to memory of 576	1040	DllCommonsvc.exe	69
PID 1040 wrote to memory of 576	1040	DllCommonsvc.exe	69
PID 1040 wrote to memory of 576	1040	DllCommonsvc.exe	69
PID 1040 wrote to memory of 1052	1040	DllCommonsvc.exe	70
PID 1040 wrote to memory of 1052	1040	DllCommonsvc.exe	70
PID 1040 wrote to memory of 1052	1040	DllCommonsvc.exe	70
PID 1040 wrote to memory of 1564	1040	DllCommonsvc.exe	71
PID 1040 wrote to memory of 1564	1040	DllCommonsvc.exe	71
PID 1040 wrote to memory of 1564	1040	DllCommonsvc.exe	71
PID 1040 wrote to memory of 2292	1040	DllCommonsvc.exe	72
PID 1040 wrote to memory of 2292	1040	DllCommonsvc.exe	72
PID 1040 wrote to memory of 2292	1040	DllCommonsvc.exe	72
PID 1040 wrote to memory of 2012	1040	DllCommonsvc.exe	73
PID 1040 wrote to memory of 2012	1040	DllCommonsvc.exe	73
PID 1040 wrote to memory of 2012	1040	DllCommonsvc.exe	73
PID 1040 wrote to memory of 2136	1040	DllCommonsvc.exe	74
PID 1040 wrote to memory of 2136	1040	DllCommonsvc.exe	74
PID 1040 wrote to memory of 2136	1040	DllCommonsvc.exe	74
PID 1040 wrote to memory of 2068	1040	DllCommonsvc.exe	123
PID 1040 wrote to memory of 2068	1040	DllCommonsvc.exe	123
PID 1040 wrote to memory of 2068	1040	DllCommonsvc.exe	123
PID 1040 wrote to memory of 1988	1040	DllCommonsvc.exe	76
PID 1040 wrote to memory of 1988	1040	DllCommonsvc.exe	76
PID 1040 wrote to memory of 1988	1040	DllCommonsvc.exe	76
PID 1040 wrote to memory of 1984	1040	DllCommonsvc.exe	77
PID 1040 wrote to memory of 1984	1040	DllCommonsvc.exe	77
PID 1040 wrote to memory of 1984	1040	DllCommonsvc.exe	77
PID 1040 wrote to memory of 900	1040	DllCommonsvc.exe	78
PID 1040 wrote to memory of 900	1040	DllCommonsvc.exe	78
PID 1040 wrote to memory of 900	1040	DllCommonsvc.exe	78
PID 1040 wrote to memory of 884	1040	DllCommonsvc.exe	79
PID 1040 wrote to memory of 884	1040	DllCommonsvc.exe	79
PID 1040 wrote to memory of 884	1040	DllCommonsvc.exe	79
PID 1040 wrote to memory of 1808	1040	DllCommonsvc.exe	80
PID 1040 wrote to memory of 1808	1040	DllCommonsvc.exe	80
PID 1040 wrote to memory of 1808	1040	DllCommonsvc.exe	80
PID 1040 wrote to memory of 2444	1040	DllCommonsvc.exe	92
PID 1040 wrote to memory of 2444	1040	DllCommonsvc.exe	92
PID 1040 wrote to memory of 2444	1040	DllCommonsvc.exe	92
PID 2444 wrote to memory of 1432	2444	DllCommonsvc.exe	109
PID 2444 wrote to memory of 1432	2444	DllCommonsvc.exe	109
PID 2444 wrote to memory of 1432	2444	DllCommonsvc.exe	109
PID 2444 wrote to memory of 2892	2444	DllCommonsvc.exe	110
PID 2444 wrote to memory of 2892	2444	DllCommonsvc.exe	110
PID 2444 wrote to memory of 2892	2444	DllCommonsvc.exe	110
PID 2444 wrote to memory of 2964	2444	DllCommonsvc.exe	111
PID 2444 wrote to memory of 2964	2444	DllCommonsvc.exe	111
PID 2444 wrote to memory of 2964	2444	DllCommonsvc.exe	111
PID 2444 wrote to memory of 1288	2444	DllCommonsvc.exe	112
PID 2444 wrote to memory of 1288	2444	DllCommonsvc.exe	112
PID 2444 wrote to memory of 1288	2444	DllCommonsvc.exe	112
PID 2444 wrote to memory of 2372	2444	DllCommonsvc.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe
"C:\Users\Admin\AppData\Local\Temp\75b13dde011211b5513b92084ebf378e5557f0ed0e3abc9e26f2ee5b63b1e2f7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\es-ES\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Start Menu\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\schtasks.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\lsm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KYZNZVgiVS.bat"
        6⤵
        
        PID:3028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2068
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat"
        8⤵
        
        PID:2000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1516
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat"
        10⤵
        
        PID:2484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:408
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat"
        12⤵
        
        PID:2824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:3052
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat"
        14⤵
        
        PID:2240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2808
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"
        16⤵
        
        PID:2640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2604
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat"
        18⤵
        
        PID:1696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1948
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat"
        20⤵
        
        PID:1044
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:548
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SaOkt9ru2m.bat"
        22⤵
        
        PID:2924
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2504
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat"
        24⤵
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2620
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Journal\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Start Menu\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Links\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\Links\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Links\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42a18f3976cf29899fb1d82f4e3a1762

SHA1
5e00b03dc533697e4cd20890de95eaa6b94515a1

SHA256
e475123b2298703f444373cbd66d25301b7cdaa6f9af5b38303765c45cc06602

SHA512
048df2e0b2f7c539fcc4c174cf979a6fa174f3500966c3091344e11f79d830d8455b4189591dd22e57aefcdce1fa00cd8ce0aa15d7bf67618bf095cdf87af1a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13650f88a5cfc10e69797ffb511e41d2

SHA1
5b67788a9f1f40bca8b71df4156182d277c5ef51

SHA256
a0d8a3eec6338a2c4af8e00ea29113b5e0b19dbfe4af0bcf19e3f214a42beff0

SHA512
a90855918f118a1d04b9174791cb0a3451515f60d28c3bf029b9a5433e5db79ac0d47de4f370dcc5194bbbf4b81909da185dad326342f4b81978596c545a5291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7df03f4a58f19921e13c6eb3877f446e

SHA1
89b088abc43bd8ee3097fd685a7643de80c535fc

SHA256
145e590b2f7bb170b468a9e8a668346f2f5d9be3120cccc70a7ce3034eabdfbb

SHA512
106d1e3a5b36546b73a661bc64e34f26dc2f3ca1a85b6013da724c7de29c0a15cedc2af170cf5737bf2fe1d24a62f6c762d00459bba3025a2f69593984e7c3d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21755db32ef432c01c1bdd8cdbf2feb1

SHA1
b626c4d4d8cffb54de1e3f16add3165e2514a355

SHA256
266c2ff9af637407d0f0a165100e4870613cd93045ce698c3e81c6954a8380eb

SHA512
efe7d417113c44fa9bca98536a99e2f15058be68b5c69496e7cc695a489ffef052edb354f38fabace8e9a703e54cf8c59e2d5691871dd9fb475cf08abb834020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
526136072d5dada47910173b52bef007

SHA1
f129131e2dbb57f94d7988ab0244069614271c05

SHA256
f27a6e8661ab3c717f3824b4774180352d90f1bc4d3010571ad99df84faf3031

SHA512
7477dc905095efa848d94c6b111dc3594dc89111b3604f8decbf35b89dcb0f315adf7701011175d134f27a614e78f778e1fbc4f71bb9c2cf873d3c03b20beecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1a1e8f5f20f9317fdb7475b18e2e04a

SHA1
f9c5ef0b8683210cb5ba5f10bd1e6d51edfb20fa

SHA256
596f968a2145b7c1c8434c18aa6a62d3d7139ca33b208678aa66b284e5133336

SHA512
9d62cc3c9d1137dbc64c78faa90b27ac907fa62da96c9ef171a08452c0a23f9bcc2fd3ca00da7b416ab03d83446fa2dd158074bb92c01702e2c347759f18c202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a5ad5561cc496747797f9a8ab22f023

SHA1
34ea7330ed6c8db4f02b21489c27dc39cb16cac1

SHA256
06400e5d414f659618763d0d46796cb1961383e5e721dc43068851c12c391f22

SHA512
99fadf51a5ece6b7f2e0612ce422dde7c4d8b2730ed087f499440e33093287c6f653b12ae9a168649a4895d9d7edd0a31ae26d29e53d0deb7162a0f2cfeda3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76212e87f0be1149679a2ee1d1353611

SHA1
cec5aa1a9f7800d3b4d7ac6702abaa19a1e693b1

SHA256
21323f05718c232f230e408ab2febe3c08af52379d89fcd7d55b9f7a7c26a1bd

SHA512
13bff7c6bd8920bc620f09d5ca8778af31ecf700e1079794d6be4512acc1dac2d2c724e5fbeaa5882591f9a3be85437924fbc0e86a4b776317ae0763d9914eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat

Filesize
240B

MD5
7cd8f0a12e1315558c49fe79a41b5a7e

SHA1
58c56adb24cb73bfb73fabbef1255197ebc10122

SHA256
7bfb6d4a4ef70f19d0a9288445fe55c3ae13bfd9b1a0d82d316b642d9437e917

SHA512
c80d073aaf72e0aef34d452d36abc775064a93f6c78bfa7fe453e38e815701eb3795549e046c2c98c3cc1096abb11bf59af450129dd4dc4bd909cf721d228405

Download Submit
C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat

Filesize
240B

MD5
b899b227b5845888cd9c812cf40bfcdb

SHA1
c5f3781e22bee3ecdf729434bc44e97577286b09

SHA256
f3596e885a8475258890db8faa921a381620ec3b9a6c6f620245503e058268c9

SHA512
c46d461c02ed1a0f26a2e2a818efa4427e460cc442be82c3887e78d66b63bf1050a1d21b11a558f4adf4f725ee1fa2037802b12bcaafba89eb1a589262a31143

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HKL0gj8mBn.bat

Filesize
240B

MD5
1fa1a560cc72868b5794de7bf8209375

SHA1
db02f242b55cb569dac6571acd730c4232b68b85

SHA256
384bf8cdabe4e2699790e23276b7d951f93a04c9645823cbf44b7f24052e7ae0

SHA512
108bbfc77373fa1fe359cf5137fcf821814650bc24f939f47a88f516dbf7530ba621a50387b2cc245ccc2eb52445d76d69dffdc9113e0329e3fe784e5ecfc198

Download Submit
C:\Users\Admin\AppData\Local\Temp\KYZNZVgiVS.bat

Filesize
240B

MD5
8c03b9335d8a9a8e5350036c1c9fe65e

SHA1
e9548e9781f12ebe38f508d9626ca25843e131d6

SHA256
0b29a7fd5fabf77709af363fa2887b98d4c95b3ed9a2452a5633b2581ff73379

SHA512
6154e37cdbaf33d0bd9356130066287b0e74d3d3f8568f5c82d9c1a65a4398aeb29a08de7b978090eff4e1f8c91aaaa89ec64be65bdfa9443e8c4d9979efde82

Download Submit
C:\Users\Admin\AppData\Local\Temp\SaOkt9ru2m.bat

Filesize
240B

MD5
96d1c1efaf1306b44360cd7949fad5b0

SHA1
852a8afdbd113336b3cfe0b833871e0a1edf7e57

SHA256
8bd032f01086e330d9a352709ad5db07d797b5d699a1d8c43c3e86499df2a56a

SHA512
94ffb4a42c38a92e58613bfa532f06cca3e092285dd54d84656e6077e81abbcefa62f58b61db54ab5dfcc69d25266dbc16bdad195b90ab2a7df9519674cf60d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar811.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\W3ML2JPNvQ.bat

Filesize
240B

MD5
d16346a792adfd79f1d645610cfee80f

SHA1
fc4516861ca1d398da7d8b85c90ead36fc5c6147

SHA256
7fe6f93a90e1be568953d6386b9f33ac50285f2db1b89e020e21463b60315b63

SHA512
7626c98ee6a7c765dc25f42a3dfc2e45c446d139bc8f2d26474a2a5f329038fe8b5e97a9abd90ac2127d7a604ebb8d0601dede780cca22f1b07845e2a81ff217

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZHEG9SYztW.bat

Filesize
240B

MD5
8c7f900a98fa1ed4e86c4aa2558c8672

SHA1
d1b7cb7132144d523175ba94dfc676a10b95e87b

SHA256
e4491cddaf3220936e184a5351c7c38204ebae51d6c40ef89e35b00ec33b81df

SHA512
a566c484b5ef4e08e4335c08fe630235769d93018babf5d858a8c5c43e8e1019925c70e54fecdc6f37ce7717ba0508b09f182c461d1c567f8b677c418f821771

Download Submit
C:\Users\Admin\AppData\Local\Temp\hC9SSnetfo.bat

Filesize
240B

MD5
e78b31048ea802db92157a3fd05181ab

SHA1
3c697797c58398308a6286c5acacccfdeb414a5a

SHA256
3e7f9cd7927550a7b65d95cc026cda8858c88919db379c949654cf50e2c2a935

SHA512
7d72d6d563f50c878074b418a577ab58ed516a12b0421af6711de5badf75ddcff19ceaa125418c7bf765a860fb83a23f7c18cdbc740527d47220166c3e618ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hibqn60Xcy.bat

Filesize
240B

MD5
018f248d87d1d646bfe26570c419df62

SHA1
9e014ac1071df3128056c693278a318aaf565f93

SHA256
4fb53c4925e89e0a632a41ff0af8bebbd9fd711eb1c21e31cbcc708badde13cd

SHA512
a15d79c221b192b9f2aa9699085e4cc07eba51e11e60f3d89284b185dd122c356b1c83ad186dab77d17d84ba78de24a143dc6c80a7707808fe07763392f0d4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qUPyb5cGVE.bat

Filesize
240B

MD5
bb8b91a600c93f9f410c616e44ffb94e

SHA1
a5bad345e2c5b49194df3cba63b269a689b40717

SHA256
e5975b057e5965619a0ea7d9193127e41a77814534abe610a8cd6bd6dd568892

SHA512
6f70914bcb4db6c51d122fc9c045f53359e1e7e8a996285992512f9dbdfaac100dd9c243700f403e72d718da0a0d6eb7e91f711c1e88700721f869373eedc394

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
36570b8d223e39fc1d24706f248ff0db

SHA1
34f5176d395cee365d72303efc4907d0e07d8d6f

SHA256
850677db4957604dc4883ab697f1190ce0bf1dfcc5d9b8cd484f74e526a05c20

SHA512
31daf98b6b3a815564324a05fd05f36413d8ae395a36e3930057d729a63b2df76e24955a9838d19a299181d872809078ed54ec1cc600f733a93cbc130edf3e35

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1040-17-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1040-14-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1040-16-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/1040-13-0x0000000000CF0000-0x0000000000E00000-memory.dmp

Filesize
1.1MB

Download
memory/1040-15-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/1260-211-0x0000000000040000-0x0000000000150000-memory.dmp

Filesize
1.1MB

Download
memory/1432-123-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1432-122-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1664-451-0x0000000000980000-0x0000000000992000-memory.dmp

Filesize
72KB

Download
memory/1748-391-0x0000000001220000-0x0000000001330000-memory.dmp

Filesize
1.1MB

Download
memory/1952-271-0x0000000000DD0000-0x0000000000EE0000-memory.dmp

Filesize
1.1MB

Download
memory/2064-331-0x00000000000F0000-0x0000000000200000-memory.dmp

Filesize
1.1MB

Download
memory/2068-46-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2068-47-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2444-67-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/2500-688-0x0000000000390000-0x00000000004A0000-memory.dmp

Filesize
1.1MB

Download
memory/2560-152-0x0000000000EC0000-0x0000000000FD0000-memory.dmp

Filesize
1.1MB

Download