dcrat | c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe
Size

1.3MB
MD5

df635773d92bdf1fd21d2a2525b96bfd
SHA1

f226e683f8e7c46310d7d3dc285de8fc690485d4
SHA256

c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317
SHA512

3a7cd2342d23aae2a4f2a27a665ee68c6c3d029a88e3310e77bce7ce906a212eb4311d8a68c0a3aaf31da70c8f0623a535675bba6750c0cae82f7a41f2ec8446
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2836	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016ace-12.dat	dcrat
behavioral1/memory/2804-13-0x00000000011F0000-0x0000000001300000-memory.dmp	dcrat
behavioral1/memory/2144-146-0x0000000000AD0000-0x0000000000BE0000-memory.dmp	dcrat
behavioral1/memory/2788-206-0x0000000000F40000-0x0000000001050000-memory.dmp	dcrat
behavioral1/memory/1008-267-0x00000000012B0000-0x00000000013C0000-memory.dmp	dcrat
behavioral1/memory/1132-327-0x0000000000320000-0x0000000000430000-memory.dmp	dcrat
behavioral1/memory/544-387-0x00000000013B0000-0x00000000014C0000-memory.dmp	dcrat
behavioral1/memory/2008-624-0x0000000000020000-0x0000000000130000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
2636	powershell.exe
2740	powershell.exe
1376	powershell.exe
3008	powershell.exe
2380	powershell.exe
2320	powershell.exe
2668	powershell.exe
3024	powershell.exe
3012	powershell.exe
2164	powershell.exe
2864	powershell.exe
3016	powershell.exe
2828	powershell.exe
2812	powershell.exe
1620	powershell.exe
2708	powershell.exe
2728	powershell.exe
2988	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2804	DllCommonsvc.exe
2144	System.exe
2788	System.exe
1008	System.exe
1132	System.exe
544	System.exe
2428	System.exe
2760	System.exe
1856	System.exe
2008	System.exe

Loads dropped DLL 2 IoCs

pid	Process
2892	cmd.exe
2892	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
27	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
20	raw.githubusercontent.com
23	raw.githubusercontent.com
31	raw.githubusercontent.com
35	raw.githubusercontent.com

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\sd\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\taskhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\b75386f1303e64	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\24dbde2999530e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\spoolsv.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\es-ES\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\es-ES\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\system\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\system\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\Fonts\System.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1664	schtasks.exe
1916	schtasks.exe
1864	schtasks.exe
2108	schtasks.exe
1072	schtasks.exe
2296	schtasks.exe
2308	schtasks.exe
1912	schtasks.exe
756	schtasks.exe
2984	schtasks.exe
2444	schtasks.exe
2100	schtasks.exe
2224	schtasks.exe
2004	schtasks.exe
1628	schtasks.exe
2944	schtasks.exe
1168	schtasks.exe
296	schtasks.exe
2520	schtasks.exe
2540	schtasks.exe
2152	schtasks.exe
2544	schtasks.exe
3020	schtasks.exe
2408	schtasks.exe
2172	schtasks.exe
2832	schtasks.exe
2268	schtasks.exe
2016	schtasks.exe
2460	schtasks.exe
2468	schtasks.exe
2524	schtasks.exe
2692	schtasks.exe
1652	schtasks.exe
1504	schtasks.exe
2796	schtasks.exe
1900	schtasks.exe
2888	schtasks.exe
2660	schtasks.exe
1156	schtasks.exe
1520	schtasks.exe
2188	schtasks.exe
2604	schtasks.exe
3012	schtasks.exe
2912	schtasks.exe
936	schtasks.exe
2120	schtasks.exe
2588	schtasks.exe
988	schtasks.exe
1904	schtasks.exe
1592	schtasks.exe
540	schtasks.exe
1748	schtasks.exe
2924	schtasks.exe
2040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2804	DllCommonsvc.exe
2804	DllCommonsvc.exe
2804	DllCommonsvc.exe
2804	DllCommonsvc.exe
2804	DllCommonsvc.exe
2828	powershell.exe
3016	powershell.exe
3008	powershell.exe
1620	powershell.exe
2708	powershell.exe
2864	powershell.exe
1376	powershell.exe
2740	powershell.exe
2164	powershell.exe
3012	powershell.exe
2636	powershell.exe
2668	powershell.exe
2380	powershell.exe
3024	powershell.exe
2404	powershell.exe
2988	powershell.exe
2812	powershell.exe
2728	powershell.exe
2320	powershell.exe
2144	System.exe
2788	System.exe
1008	System.exe
1132	System.exe
544	System.exe
2428	System.exe
2760	System.exe
1856	System.exe
2008	System.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	DllCommonsvc.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2144	System.exe
Token: SeDebugPrivilege	2788	System.exe
Token: SeDebugPrivilege	1008	System.exe
Token: SeDebugPrivilege	1132	System.exe
Token: SeDebugPrivilege	544	System.exe
Token: SeDebugPrivilege	2428	System.exe
Token: SeDebugPrivilege	2760	System.exe
Token: SeDebugPrivilege	1856	System.exe
Token: SeDebugPrivilege	2008	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2152	2128	c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe	30
PID 2128 wrote to memory of 2152	2128	c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe	30
PID 2128 wrote to memory of 2152	2128	c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe	30
PID 2128 wrote to memory of 2152	2128	c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe	30
PID 2152 wrote to memory of 2892	2152	WScript.exe	31
PID 2152 wrote to memory of 2892	2152	WScript.exe	31
PID 2152 wrote to memory of 2892	2152	WScript.exe	31
PID 2152 wrote to memory of 2892	2152	WScript.exe	31
PID 2892 wrote to memory of 2804	2892	cmd.exe	33
PID 2892 wrote to memory of 2804	2892	cmd.exe	33
PID 2892 wrote to memory of 2804	2892	cmd.exe	33
PID 2892 wrote to memory of 2804	2892	cmd.exe	33
PID 2804 wrote to memory of 2812	2804	DllCommonsvc.exe	89
PID 2804 wrote to memory of 2812	2804	DllCommonsvc.exe	89
PID 2804 wrote to memory of 2812	2804	DllCommonsvc.exe	89
PID 2804 wrote to memory of 2828	2804	DllCommonsvc.exe	90
PID 2804 wrote to memory of 2828	2804	DllCommonsvc.exe	90
PID 2804 wrote to memory of 2828	2804	DllCommonsvc.exe	90
PID 2804 wrote to memory of 3024	2804	DllCommonsvc.exe	91
PID 2804 wrote to memory of 3024	2804	DllCommonsvc.exe	91
PID 2804 wrote to memory of 3024	2804	DllCommonsvc.exe	91
PID 2804 wrote to memory of 3016	2804	DllCommonsvc.exe	92
PID 2804 wrote to memory of 3016	2804	DllCommonsvc.exe	92
PID 2804 wrote to memory of 3016	2804	DllCommonsvc.exe	92
PID 2804 wrote to memory of 2864	2804	DllCommonsvc.exe	93
PID 2804 wrote to memory of 2864	2804	DllCommonsvc.exe	93
PID 2804 wrote to memory of 2864	2804	DllCommonsvc.exe	93
PID 2804 wrote to memory of 2668	2804	DllCommonsvc.exe	94
PID 2804 wrote to memory of 2668	2804	DllCommonsvc.exe	94
PID 2804 wrote to memory of 2668	2804	DllCommonsvc.exe	94
PID 2804 wrote to memory of 2728	2804	DllCommonsvc.exe	95
PID 2804 wrote to memory of 2728	2804	DllCommonsvc.exe	95
PID 2804 wrote to memory of 2728	2804	DllCommonsvc.exe	95
PID 2804 wrote to memory of 2320	2804	DllCommonsvc.exe	97
PID 2804 wrote to memory of 2320	2804	DllCommonsvc.exe	97
PID 2804 wrote to memory of 2320	2804	DllCommonsvc.exe	97
PID 2804 wrote to memory of 2404	2804	DllCommonsvc.exe	99
PID 2804 wrote to memory of 2404	2804	DllCommonsvc.exe	99
PID 2804 wrote to memory of 2404	2804	DllCommonsvc.exe	99
PID 2804 wrote to memory of 2636	2804	DllCommonsvc.exe	100
PID 2804 wrote to memory of 2636	2804	DllCommonsvc.exe	100
PID 2804 wrote to memory of 2636	2804	DllCommonsvc.exe	100
PID 2804 wrote to memory of 2380	2804	DllCommonsvc.exe	101
PID 2804 wrote to memory of 2380	2804	DllCommonsvc.exe	101
PID 2804 wrote to memory of 2380	2804	DllCommonsvc.exe	101
PID 2804 wrote to memory of 3008	2804	DllCommonsvc.exe	109
PID 2804 wrote to memory of 3008	2804	DllCommonsvc.exe	109
PID 2804 wrote to memory of 3008	2804	DllCommonsvc.exe	109
PID 2804 wrote to memory of 2708	2804	DllCommonsvc.exe	110
PID 2804 wrote to memory of 2708	2804	DllCommonsvc.exe	110
PID 2804 wrote to memory of 2708	2804	DllCommonsvc.exe	110
PID 2804 wrote to memory of 2164	2804	DllCommonsvc.exe	111
PID 2804 wrote to memory of 2164	2804	DllCommonsvc.exe	111
PID 2804 wrote to memory of 2164	2804	DllCommonsvc.exe	111
PID 2804 wrote to memory of 1376	2804	DllCommonsvc.exe	112
PID 2804 wrote to memory of 1376	2804	DllCommonsvc.exe	112
PID 2804 wrote to memory of 1376	2804	DllCommonsvc.exe	112
PID 2804 wrote to memory of 3012	2804	DllCommonsvc.exe	113
PID 2804 wrote to memory of 3012	2804	DllCommonsvc.exe	113
PID 2804 wrote to memory of 3012	2804	DllCommonsvc.exe	113
PID 2804 wrote to memory of 2740	2804	DllCommonsvc.exe	114
PID 2804 wrote to memory of 2740	2804	DllCommonsvc.exe	114
PID 2804 wrote to memory of 2740	2804	DllCommonsvc.exe	114
PID 2804 wrote to memory of 2988	2804	DllCommonsvc.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe
"C:\Users\Admin\AppData\Local\Temp\c094c41942ec391368bc4e399b78ea1756079d59747dfee2f0364a33f4504317.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\sd\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Start Menu\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\lua\http\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\NetHood\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\es-ES\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K2xGawUNUz.bat"
        5⤵
        
        PID:1868
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:392
      - C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mTJ33xL03H.bat"
        7⤵
        
        PID:544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:756
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat"
        9⤵
        
        PID:3052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2728
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat"
        11⤵
        
        PID:1124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1740
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RFyBjogktz.bat"
        13⤵
        
        PID:2992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2888
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QwDZd8tkMK.bat"
        15⤵
        
        PID:844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2964
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat"
        17⤵
        
        PID:2504
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1740
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kwOVarqRTQ.bat"
        19⤵
        
        PID:904
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3004
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OS3CX563UF.bat"
        21⤵
        
        PID:1680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2232
        
        C:\Windows\Fonts\System.exe
        
        "C:\Windows\Fonts\System.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat"
        23⤵
        
        PID:2432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\lua\sd\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Start Menu\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Start Menu\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\system\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\system\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\system\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\http\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\lua\http\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\NetHood\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\NetHood\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Default\NetHood\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8393a9575db680306486730239257864

SHA1
922ee48a5dee62541ef229bd43adaf90e5552db2

SHA256
1601c0a382be682ed67fa991898a3bdb53de31a6bd64a8a7a102e78b85fe1f42

SHA512
044084fde35a96d2db68f96382e31c58e2db85957f3f22f4db33f1aa2fa60c9c2ae0c82e303c7a5b92e705ecc7521db2408f895f6f6cf37c8c05ea3d1b776dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6c5ad7abe2a6762a27bbe610603b057

SHA1
d910ba8c40c50effc3228061ccd92a65fc56c40e

SHA256
bbf68b9d447c46d5cc68b81974333d69bf4b01840dbd7c55fd60020bed313857

SHA512
0d2be3058b96cfc7df0ebebbd8e93f28f174ab302d06570e3e8158e947c3bea2c3e04e916af182828b54dc028bf721650836e87a4bac02452b1da936b114b493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3e21b00731648b1205b8e7c198f1e65

SHA1
438989b8bad3fa9d23961cc84f9e6421fbb4ca2b

SHA256
d19d81bc9620215d04ef53d051c31e4b53603eed2fbc4dbda7297d8c140e3f15

SHA512
2793d87865e0d07e014e9f3a0fb0450ec4fe39efc95562732cb8a2fbd7cc719be09dbe0e4a883433c60b5a483d34925dafbb6561e1f25fc9ce3025f2d804149e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
170676e72f568c7d82bdcfae41a6dbb9

SHA1
664a3ed67695f771f945178125a4fae3bcd3029e

SHA256
7a4eb288477f824a7300f93e54990fc37f538c0ebda0a2f010d94f78902cce64

SHA512
fe38fa2647a887f32a2f636d954b866c10da3d13589ebe813816fa262d32ac3cdef04938e41b4c90bf7c6c2ff2ad6537f22f8a1a8bf49f0008742a7281da6985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cb509a98ff1a4b2dd066cead4c7cf3b

SHA1
1bae723437aa4180d86426c1594f8a12299abecc

SHA256
6cd9f797c2cce5a05a82596cd3744ecb73bfb36e28c319a5d29464763156a717

SHA512
f3f906107da06024daeb60aabbb6396b0e34540536ee4b42b05f847eee3e7aba1b3c65b40ce352727eee5813ba16dbd34776a3deadae841e41a92f0c9a48b467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0180a302afdd05af03bfeeea91ac670a

SHA1
97592a14c631ff8b96c4ba7426d5dfe6e49f072c

SHA256
2dd62d1705ec371cf9173cd7e3025661b58c57b7bac7e395ba636468248004ea

SHA512
1cbb3118bc035b23343a2a93c552ae745725d125063eefa8028c6217eac0051f28af717019cd5a426bbc2816ffbf72b824b4433c880a5f8aff3b296f62096dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b5de1498dac8b2b92cb8ae858eb1be0

SHA1
d121d2b0028a7e17c10e6dac83e69250681abda1

SHA256
585d2535421ef06ac18e7d8f4180a85473222d1057c268e3d616564da7b408e4

SHA512
705f56a9c60afc7851f2b5669cbbb269f8e73e7b970bfd317cd5c970035e78c5ef863a70bffde4ae821fdcd3eccd32c4b67c9ddc9d7104dd976c3347797e32b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5852e61c619cedc508218a12d7470b

SHA1
3d17fc606a60fa2043a6f200bd03f05f77ce9f84

SHA256
f624bd839a91066dd5697891e071e3b7cde2fc7ae5724e0ce1b940071500b59d

SHA512
66a4d3b1abe0ad5f87241d8f1b3fe55165b56681e3d5c705cdc743e96a2c1c701fcaa88ef790b92c7eaa8801b1f0f4841eb19e42d728d257dc21412c9b53e923

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE5CF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\K2xGawUNUz.bat

Filesize
192B

MD5
4dbb0b21257486da0155666f834f43bb

SHA1
964187b576f45ee1161841f6ba75b79611d43f13

SHA256
99e3f57e961bc3dd0f75404e47f0e1986ff08a01f385b36c1026e189d566b634

SHA512
b3a9f54541b28373416e93cae00e284a1b6fa7711d387d779c36e88b06cb605ba0460bf5b010f66049a1f824a0856ff3934dc18212d83e894e9c84986d4360b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVYyjDtEXm.bat

Filesize
192B

MD5
e787d2190fd94ce5d6d1b84aedbbd198

SHA1
ce939792f9719f075a16d99a84b8f98156ed840b

SHA256
dc048068e60fbcd71a7509040ee63c8c29c72be3072c64c902def3158cc5f7f6

SHA512
fb75afc75f3df209b23479f451d7fafef5043c90c636b08e4192889bc689fd365186623fbedd1ef620208379ee882f27b1877b670c3e179ff751cb97ddbf638b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OS3CX563UF.bat

Filesize
192B

MD5
f2304d1674974f294f7e10e2b132ecc8

SHA1
4edd82a223c24cd8c580025142158a6251f2261a

SHA256
1b7b176abd1a9854576044827afd7c980a2bbc1473bc564ac29cae9c22339858

SHA512
c7cf656ace7ef0a593967d4cf8a10153cee723a54ae4ef29f3249a3d6f732382c47657e55c21a0f3eae9bbb7d95ae311a32532e4cb2e156dab964ae283fda8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\QwDZd8tkMK.bat

Filesize
192B

MD5
59c04d588b381959c8c7a8eadd58976e

SHA1
489d3506a8a1a9c5f7943bdcbd4092ef154456b9

SHA256
2f12afc92cd9b459bd00bf0de696ce178ddc2654d99fb3ed4f90571cb7867128

SHA512
d0c7f8bd0116979579d545942a30452a64486a4f30d6fe07d2d212fe917dfc44bc29ec242c516613f6b874a0afb9248d5d84f929b19c88b3313d0f55fb66b416

Download Submit
C:\Users\Admin\AppData\Local\Temp\RFyBjogktz.bat

Filesize
192B

MD5
eb5f9ce41cedfd1d1f30efc352e8e9da

SHA1
87345d3bb0487ed7df3998f8af9ddc4bbfd51fb9

SHA256
d7b878876576de5763902e537050b3f1337ea393b24205fee621e73ea6484379

SHA512
29043c998555011fca78d00c6ee1a3954cf200a37ef8b1851f8f67f4cd917a8d102a71f3f104bdc83e40ba9c883e6a5751c79c22269033bd17df38caf13c4250

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat

Filesize
192B

MD5
2a9471c8b4186d2e5ae36729f5e83b9a

SHA1
656cc09b8e2f504395e8b06c67050a339b4c59df

SHA256
8f09d083d30536cd44bc894e373474e1e9c3af01315c46012304f770cb6f5a19

SHA512
810be2b03903263bd50dbe4ccc2511b97722a422e946045ebdec87779ec2f896a52dab0462664c49835628d61efe25dbb5fbdb9518fd5a5f2cfb8b271c7bde2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\dekjrv1PTF.bat

Filesize
192B

MD5
745f382063b084e82d3b01ed720b0055

SHA1
9b4f5f35dec57cc518ba5629434289e4ab2fb4c5

SHA256
44de9a9f190e82ac8ed482f606a58254f13ede7d600373be037a0a014a89cdc3

SHA512
a51dff2dbfd22d77c296328b0add55d100486c1b098660070e166da8f195885e149030886b9886b56600ac7ebe061c8f926420ce959b16a1d58b19f5db3bee5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat

Filesize
192B

MD5
548eb8bdc30cf54eb3ad086a9df252a3

SHA1
670665636e90f44dea8ce569a60e5258d7cbdd34

SHA256
8bdeac8751ddf3b9cb5ea90380ff1f1fc2191b7cb9399c6489170e9f47b58205

SHA512
8e493747914556fbe517ab348b8adb932083601ddf3185b5e050e31ac4d9dd8bab38b2482cb019bcb307b8347eeda6b079702f99921a83862ff69bb534440c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kwOVarqRTQ.bat

Filesize
192B

MD5
8db33893f2353fecde145fbcd2d2fa33

SHA1
3a2c84bc6902eb7edd1d257016297678e3332a6d

SHA256
437bd7608c5747d538af7c58875397db4a162de20632a74ce7dd294384c08ccb

SHA512
49c4428096094946de59d46d4e5308df4588c23bc7ed2554f91de0e295283b015383c174d633870671318b49992e6c270be4fee4b9b64e5ee0f769ffd691670e

Download Submit
C:\Users\Admin\AppData\Local\Temp\mTJ33xL03H.bat

Filesize
192B

MD5
9ffb8ce7f4f9271d75525d64f41f70b2

SHA1
ee1f7ccc89b9d7fbde91edf9f9489b28dd9102ff

SHA256
7e57449446a23ccc63e46f5d7240a622527ea48d595437d70798299bd392d25f

SHA512
75f2691cf2afdb7d0a7aa701b8ab3d6c6c67a8b7a07077475c7b56db446ccc599e412b800a7a9564804e579a53d77ebcee59c56144de64ff107495d212277c1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KK1D4WTJJKBDI1YAHN24.temp

Filesize
7KB

MD5
4619810334c09a35e6ce1094e1104e91

SHA1
41d4be2694ca20e87b94643cb678e135c47f5b59

SHA256
a53cc097f2dd396fb0cf5677fd5879e79fef86c0c4c4e4847ddd1f2477813b24

SHA512
6f5d94d395e8572c17580fc92da9f20128c4c064af1ba253881cd8b56cae50b1a66988d52b01c2a32d288cfb0535b0d3a570a33bf62eb282704d29f6d1b2989d

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/544-387-0x00000000013B0000-0x00000000014C0000-memory.dmp

Filesize
1.1MB

Download
memory/1008-267-0x00000000012B0000-0x00000000013C0000-memory.dmp

Filesize
1.1MB

Download
memory/1132-327-0x0000000000320000-0x0000000000430000-memory.dmp

Filesize
1.1MB

Download
memory/2008-624-0x0000000000020000-0x0000000000130000-memory.dmp

Filesize
1.1MB

Download
memory/2144-146-0x0000000000AD0000-0x0000000000BE0000-memory.dmp

Filesize
1.1MB

Download
memory/2144-147-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2788-207-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2788-206-0x0000000000F40000-0x0000000001050000-memory.dmp

Filesize
1.1MB

Download
memory/2804-15-0x0000000000450000-0x000000000045C000-memory.dmp

Filesize
48KB

Download
memory/2804-14-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2804-16-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/2804-13-0x00000000011F0000-0x0000000001300000-memory.dmp

Filesize
1.1MB

Download
memory/2804-17-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2828-68-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/3016-69-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download