dcrat | df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe
Size

1.3MB
MD5

8e95619915e8bb31f5ef8388b0644bcf
SHA1

9bca5457a82ba0611fd8a8125440cc22986a0ae2
SHA256

df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe
SHA512

3d328fb368d4510afe711662930a955f3bf1e9ea9982b59709603f43798777072189b3792a57cab515153b0252f8a14ff4ba8ab19365bf0e791c61e0c4d2dfa7
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2620	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2620	schtasks.exe	34

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016b86-9.dat	dcrat
behavioral1/memory/2648-13-0x0000000000920000-0x0000000000A30000-memory.dmp	dcrat
behavioral1/memory/2528-71-0x0000000000310000-0x0000000000420000-memory.dmp	dcrat
behavioral1/memory/704-215-0x0000000001230000-0x0000000001340000-memory.dmp	dcrat
behavioral1/memory/2368-454-0x0000000000360000-0x0000000000470000-memory.dmp	dcrat
behavioral1/memory/1016-514-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/2220-574-0x0000000000B90000-0x0000000000CA0000-memory.dmp	dcrat
behavioral1/memory/2140-634-0x00000000012D0000-0x00000000013E0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1392	powershell.exe
1096	powershell.exe
2544	powershell.exe
2832	powershell.exe
2560	powershell.exe
872	powershell.exe
2568	powershell.exe
2548	powershell.exe
300	powershell.exe
2652	powershell.exe
2736	powershell.exe
2956	powershell.exe
2576	powershell.exe
2756	powershell.exe
1712	powershell.exe
1552	powershell.exe
2292	powershell.exe
2704	powershell.exe
2604	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2648	DllCommonsvc.exe
2528	OSPPSVC.exe
704	OSPPSVC.exe
1664	OSPPSVC.exe
2940	OSPPSVC.exe
2576	OSPPSVC.exe
2368	OSPPSVC.exe
1016	OSPPSVC.exe
2220	OSPPSVC.exe
2140	OSPPSVC.exe
3052	OSPPSVC.exe

Loads dropped DLL 2 IoCs

pid	Process
2708	cmd.exe
2708	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
17	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com
37	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
13	raw.githubusercontent.com
21	raw.githubusercontent.com
24	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\it-IT\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\it-IT\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Setup\State\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\debug\WIA\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\debug\WIA\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\Resources\audiodg.exe	DllCommonsvc.exe
File created	C:\Windows\Resources\42af1c969fbb7b	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2028	schtasks.exe
2616	schtasks.exe
1740	schtasks.exe
2408	schtasks.exe
2992	schtasks.exe
2320	schtasks.exe
1944	schtasks.exe
868	schtasks.exe
1292	schtasks.exe
2312	schtasks.exe
1192	schtasks.exe
1172	schtasks.exe
2952	schtasks.exe
1924	schtasks.exe
1800	schtasks.exe
1648	schtasks.exe
2120	schtasks.exe
2236	schtasks.exe
896	schtasks.exe
2800	schtasks.exe
2680	schtasks.exe
1884	schtasks.exe
2528	schtasks.exe
1720	schtasks.exe
840	schtasks.exe
1788	schtasks.exe
2924	schtasks.exe
3044	schtasks.exe
2272	schtasks.exe
1220	schtasks.exe
1716	schtasks.exe
2004	schtasks.exe
856	schtasks.exe
1524	schtasks.exe
1932	schtasks.exe
1540	schtasks.exe
2816	schtasks.exe
2936	schtasks.exe
1012	schtasks.exe
2864	schtasks.exe
2856	schtasks.exe
1408	schtasks.exe
2184	schtasks.exe
1940	schtasks.exe
3048	schtasks.exe
3024	schtasks.exe
1520	schtasks.exe
1448	schtasks.exe
3020	schtasks.exe
2844	schtasks.exe
832	schtasks.exe
892	schtasks.exe
1704	schtasks.exe
532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2648	DllCommonsvc.exe
2704	powershell.exe
2544	powershell.exe
2292	powershell.exe
1096	powershell.exe
2560	powershell.exe
1552	powershell.exe
2736	powershell.exe
2956	powershell.exe
2576	powershell.exe
2568	powershell.exe
1712	powershell.exe
300	powershell.exe
2756	powershell.exe
2548	powershell.exe
872	powershell.exe
2652	powershell.exe
2528	OSPPSVC.exe
2604	powershell.exe
2832	powershell.exe
1392	powershell.exe
704	OSPPSVC.exe
1664	OSPPSVC.exe
2940	OSPPSVC.exe
2576	OSPPSVC.exe
2368	OSPPSVC.exe
1016	OSPPSVC.exe
2220	OSPPSVC.exe
2140	OSPPSVC.exe
3052	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	DllCommonsvc.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2528	OSPPSVC.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	704	OSPPSVC.exe
Token: SeDebugPrivilege	1664	OSPPSVC.exe
Token: SeDebugPrivilege	2940	OSPPSVC.exe
Token: SeDebugPrivilege	2576	OSPPSVC.exe
Token: SeDebugPrivilege	2368	OSPPSVC.exe
Token: SeDebugPrivilege	1016	OSPPSVC.exe
Token: SeDebugPrivilege	2220	OSPPSVC.exe
Token: SeDebugPrivilege	2140	OSPPSVC.exe
Token: SeDebugPrivilege	3052	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2880	1728	JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe	30
PID 1728 wrote to memory of 2880	1728	JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe	30
PID 1728 wrote to memory of 2880	1728	JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe	30
PID 1728 wrote to memory of 2880	1728	JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe	30
PID 2880 wrote to memory of 2708	2880	WScript.exe	31
PID 2880 wrote to memory of 2708	2880	WScript.exe	31
PID 2880 wrote to memory of 2708	2880	WScript.exe	31
PID 2880 wrote to memory of 2708	2880	WScript.exe	31
PID 2708 wrote to memory of 2648	2708	cmd.exe	33
PID 2708 wrote to memory of 2648	2708	cmd.exe	33
PID 2708 wrote to memory of 2648	2708	cmd.exe	33
PID 2708 wrote to memory of 2648	2708	cmd.exe	33
PID 2648 wrote to memory of 2704	2648	DllCommonsvc.exe	89
PID 2648 wrote to memory of 2704	2648	DllCommonsvc.exe	89
PID 2648 wrote to memory of 2704	2648	DllCommonsvc.exe	89
PID 2648 wrote to memory of 2652	2648	DllCommonsvc.exe	91
PID 2648 wrote to memory of 2652	2648	DllCommonsvc.exe	91
PID 2648 wrote to memory of 2652	2648	DllCommonsvc.exe	91
PID 2648 wrote to memory of 2956	2648	DllCommonsvc.exe	92
PID 2648 wrote to memory of 2956	2648	DllCommonsvc.exe	92
PID 2648 wrote to memory of 2956	2648	DllCommonsvc.exe	92
PID 2648 wrote to memory of 2736	2648	DllCommonsvc.exe	93
PID 2648 wrote to memory of 2736	2648	DllCommonsvc.exe	93
PID 2648 wrote to memory of 2736	2648	DllCommonsvc.exe	93
PID 2648 wrote to memory of 2568	2648	DllCommonsvc.exe	94
PID 2648 wrote to memory of 2568	2648	DllCommonsvc.exe	94
PID 2648 wrote to memory of 2568	2648	DllCommonsvc.exe	94
PID 2648 wrote to memory of 2832	2648	DllCommonsvc.exe	95
PID 2648 wrote to memory of 2832	2648	DllCommonsvc.exe	95
PID 2648 wrote to memory of 2832	2648	DllCommonsvc.exe	95
PID 2648 wrote to memory of 2544	2648	DllCommonsvc.exe	96
PID 2648 wrote to memory of 2544	2648	DllCommonsvc.exe	96
PID 2648 wrote to memory of 2544	2648	DllCommonsvc.exe	96
PID 2648 wrote to memory of 2560	2648	DllCommonsvc.exe	97
PID 2648 wrote to memory of 2560	2648	DllCommonsvc.exe	97
PID 2648 wrote to memory of 2560	2648	DllCommonsvc.exe	97
PID 2648 wrote to memory of 2576	2648	DllCommonsvc.exe	98
PID 2648 wrote to memory of 2576	2648	DllCommonsvc.exe	98
PID 2648 wrote to memory of 2576	2648	DllCommonsvc.exe	98
PID 2648 wrote to memory of 2604	2648	DllCommonsvc.exe	99
PID 2648 wrote to memory of 2604	2648	DllCommonsvc.exe	99
PID 2648 wrote to memory of 2604	2648	DllCommonsvc.exe	99
PID 2648 wrote to memory of 2292	2648	DllCommonsvc.exe	100
PID 2648 wrote to memory of 2292	2648	DllCommonsvc.exe	100
PID 2648 wrote to memory of 2292	2648	DllCommonsvc.exe	100
PID 2648 wrote to memory of 1552	2648	DllCommonsvc.exe	101
PID 2648 wrote to memory of 1552	2648	DllCommonsvc.exe	101
PID 2648 wrote to memory of 1552	2648	DllCommonsvc.exe	101
PID 2648 wrote to memory of 1392	2648	DllCommonsvc.exe	102
PID 2648 wrote to memory of 1392	2648	DllCommonsvc.exe	102
PID 2648 wrote to memory of 1392	2648	DllCommonsvc.exe	102
PID 2648 wrote to memory of 2756	2648	DllCommonsvc.exe	103
PID 2648 wrote to memory of 2756	2648	DllCommonsvc.exe	103
PID 2648 wrote to memory of 2756	2648	DllCommonsvc.exe	103
PID 2648 wrote to memory of 1712	2648	DllCommonsvc.exe	104
PID 2648 wrote to memory of 1712	2648	DllCommonsvc.exe	104
PID 2648 wrote to memory of 1712	2648	DllCommonsvc.exe	104
PID 2648 wrote to memory of 1096	2648	DllCommonsvc.exe	105
PID 2648 wrote to memory of 1096	2648	DllCommonsvc.exe	105
PID 2648 wrote to memory of 1096	2648	DllCommonsvc.exe	105
PID 2648 wrote to memory of 2548	2648	DllCommonsvc.exe	106
PID 2648 wrote to memory of 2548	2648	DllCommonsvc.exe	106
PID 2648 wrote to memory of 2548	2648	DllCommonsvc.exe	106
PID 2648 wrote to memory of 872	2648	DllCommonsvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_df4911774dfb71d5078117e0bd85df3311b103fdf4b3558752b2aaeae3bf79fe.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\de-DE\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\ja-JP\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\it-IT\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\reports\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:300
    - - C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat"
        6⤵
        
        PID:2192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2664
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat"
        8⤵
        
        PID:2176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:340
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat"
        10⤵
        
        PID:2908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1628
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\64IFTJQeKo.bat"
        12⤵
        
        PID:876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1308
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat"
        14⤵
        
        PID:780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:924
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
        16⤵
        
        PID:1768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2540
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat"
        18⤵
        
        PID:2336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1952
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a1lJXnITmE.bat"
        20⤵
        
        PID:2252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2380
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat"
        22⤵
        
        PID:396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2572
        
        C:\providercommon\OSPPSVC.exe
        
        "C:\providercommon\OSPPSVC.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        24⤵
        
        PID:2680
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\providercommon\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\providercommon\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\Setup\State\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\State\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\WIA\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\debug\WIA\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\WIA\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Resources\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Windows\Resources\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\it-IT\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\it-IT\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\providercommon\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\reports\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\Crashpad\reports\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a96b5bfd7f8b37e1a0bd98dbfce07c69

SHA1
1d5ba64f585f9d475f50706ef1e852afb505935f

SHA256
39606e0123941815881078875c4b7789e6650173584c1be232c581b6cc414528

SHA512
dc0e818e6494be548fc6235d741e4c006e9c129277a702681b53168c362a4ebbd8be1aad94ff23488d18f01ed7edd95d518391a4596b4b124a13351b1cd590a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58d72ca43cdafb8e5e3d862ed7a54864

SHA1
a57cad827f185e47aba0e2e3f7df894a61c2cff4

SHA256
f9b92fdc3b123188a401540b47c537b56751a3f7c2445d25fa340637561ee99f

SHA512
367914a8b2382284c5b51d66f4cbe82eb8a59c97387406b07b7d86220967d496fb0697160835bdb0f994fae18b78dfcae3f86189f5c41146fa22166697c068ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b59035649394f7b06fbc1501259e49c7

SHA1
7c9ac3a1f973fccf5eda5cc7a71d261e1c099ec7

SHA256
e436588cb2ffa33aa49c9fe14487d890d24fec7649603ed9f37b6cde702475ce

SHA512
c0393b28a13bfcaa2b88e4148758e59dabb978413247903335d4d005c5cdb57d7a2c58f5a6823cabe2648007939970273814456ba570c9ca3a0a1b7ca0a7f6cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
718b43679e1b04fc00838afb05ac3053

SHA1
ca4195a858dd85636fc6425846520feb5f845f1a

SHA256
5645126ce407f01b72c1c91a238bdab4e04d93b4dc6a8fb10154724a5b36cd66

SHA512
79983423d09bae80c25757dc06398adfd61f10c959f93e2406f09fe562ec2c9d5ea1331d4eacf4a127731f06d5526030858b32fc9748ae9377b0f8d240d90fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd334172605518412d40f507f169a1bd

SHA1
088d5bc9d5c1363129b497e5547a7dd9341ff17a

SHA256
79db2c62fb8777305533d5e0cd6cf8fd8d7a01b4df3c4fad6aed4b0bbb26446d

SHA512
df9cf4c4795b887a4b06ecd902cd18c86ac8ea06613ee7914a70f786a4201b295853f63eb6a872b50116436f34f2838d9ecd6556ef466c0f631a101dac128bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b9acdb8b61c255169dcf598ef255858

SHA1
1a17c15a79492f991cc757d0a854ca8de882deab

SHA256
4a35adc44fe3d3facea46265fe710ed060920849153fbd465ec87473b5047f9b

SHA512
b474684ef6ff82a76f4e42e54af5982d727fa964a0da072fd8a037e3fed25f343fb4888dc10c6f7df50c9cfbf8a43e2d0dd552381dcc6eaf4f912246b8dedbed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88084dbf2a4fa5cda5e1f893311550ae

SHA1
2b9afcf3c7da6c03ca6ef7ce67bdb6cdca6d6a24

SHA256
5abf12c8096fb40876c06dc9d4cd98b7b2887f3121aa766b2caa2b54fb1cdb26

SHA512
4e4e474938ad9410c9d8f470920bf055f9f7e3e2cd6afba54ee67b27c4af983a6624ced505525e71ed15da6b9252bfa0da869b87ebfa366949f5b7b1ed59d1c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f1e57c3f303843d58fe181becd425bc

SHA1
997013aaffede325c41999dc19b8e9630a32640d

SHA256
6a3b29265c23690a57f0c40467e8989d1ea305a7f7991f94c0fef69bec642aa0

SHA512
909931ad881c1acb4d9e642001af93076b7705845670e8e952078b2ddc449d27c530c0a29a545c5e25d2ec1632ed1b5ba7dbff2d85bb024cbc8307b36645911a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02a750983f2ef2b817cb1d1eca3f25b

SHA1
a18d819606a8749360158797da6fc8b2304f83b5

SHA256
7ac8041ee99378fcf77eec8e296e257ad01f09eea98d8d1f100536ebb244cf6a

SHA512
7668d2b0f6cda37dc6630f3d0a51df6714aeda5e3afbe36a1a752259e939872b5a2cca729c174b00332ad1b9fd41647c21230dbd18d04791ef8a29cfeffbb54d

Download Submit
C:\Users\Admin\AppData\Local\Temp\34gW2xHJWZ.bat

Filesize
194B

MD5
72cda449372b1a1f02fa4d511a95197d

SHA1
138b574286f523aa9e2d428e6680ff57727056e1

SHA256
1b14585e2ea20759f9cc88ac656b5b7032fe41e5b9a5c73d8f3c20c4100c91d2

SHA512
58093fbb3f8f4591b7e60964ad36e29a1d3f8d5273f9c316ee51d951ffd4c58a42ffde4a93822d0b27cedc172587b8a6eaebf747bfcfec9dd1477175c8ccda32

Download Submit
C:\Users\Admin\AppData\Local\Temp\64IFTJQeKo.bat

Filesize
194B

MD5
92da4fa242e6e5496d67e214aabd2c61

SHA1
da5ea88f7f86253652aa7ce9c16392fbf202878c

SHA256
0b9b95ae7a272950d3744b5bd51e0c6e08837d681b0223b850e5659709141d23

SHA512
82b2c2b1e88b519c57186afa1330d3af3c4389f620a9adb48c27abd2cede1cbb6ceb61938f5c8f5a334e8676a4b851c6456934ed29ccb590a41fcfe21da54486

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab829A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EOJxze5tr1.bat

Filesize
194B

MD5
de686cf18362613e1df68877e1ac92dc

SHA1
8bf943022e47f59a387e81bb84a8deec000f63f6

SHA256
70f3c32abc7c7b368f0b6fbd79281c3f0f0c6c72b382793d11265578427d9870

SHA512
378eb783952f9a9e39d5e0fa82d911fb0836db9f3cc57b3f161183da0d4d47fb1db36d95e688a39b7b660be52d43d5a40aadf16423446f92e328aecee7c54f61

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
194B

MD5
d720d82c15a738555a8865657fb85a96

SHA1
a0b82150e015c1a6bfff152267b8a5ec2b2a8136

SHA256
13dccf24db26fc4644793e571a7491f7dd742f2b049801e12687210b2604c63b

SHA512
7578c1a3c9d42a7fb43b96216b9cabba259ac6cfcab36ddffbb9a94c6972a43c31210e5a785715e5de13a9b80110b4138a1a24943e0a8bb91741f0bd8c7e21a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar82AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UyITBGB0nG.bat

Filesize
194B

MD5
b03f86699c529555b5aff1243f0d816f

SHA1
1368983a066c1c77b1ec25633ac4f1acf0f43f34

SHA256
2a7b12555422349c9a4b201a6408732c973ee6e3fc8d14187dab659ea31e2baf

SHA512
3d70b38db3af2847961919854c31643d50535ae98acf0a3c0806e1da3e4e9317bb43e6d499a4b24cd7f9a7c774eb05f3b1cc0e245829184ea68db167f0c7ac66

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIXHPi7vyc.bat

Filesize
194B

MD5
5c26f3329ed564402955db20c1553d6d

SHA1
ee12c5602f79654336b4a8f45ad01358c1f9c895

SHA256
38cb920157a42a64dba4e6f5a261f1790030886c13e2ee3fb2aecb8fa2e93747

SHA512
5c793280e364f8ba3f8842132d1b2372ab4a667d35c4a05fb520d4682b28c8849b9a357c125cfd5bf616ebc0d71912ff0ad6c493e0a832f4107a846a70d901b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\a1lJXnITmE.bat

Filesize
194B

MD5
fec8201675a31a7aeaf6ded8dd527f01

SHA1
ad0a466a41dd72341b2bd7af3a0c1ab20159f4fc

SHA256
7ffb93a844976769c0f192ab021f7d2c5ea0d7d019b57da1d1352954397bb19e

SHA512
8148eaa210689ad99132317d88e9ef32256065a45dfd9498b52127b7ba70fe6c33df6e82ec2747a497d5cdfb81ca07c3bc15b99ea1597680ca4764c06988998b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

Filesize
194B

MD5
49e586d4923e9c611029bb0ad1565400

SHA1
9b289dac697eabd5dc2fe96f83a761d8ffff8295

SHA256
ad16a1348ffa4e0bf6063bfb4ef4fe7414112018817b6b15e4089002fa1982ad

SHA512
a3c2dbb36d48c99aad8457dcc3b0424cfcb075c73523805385fedab992e0762c59003424f85c3a4633fd759e256a46181fd9833abf78667febda5ed84977b36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vFDRBKGR2C.bat

Filesize
194B

MD5
2a41a49dd841c737f94dfad969898903

SHA1
278893aa4d7c609e2e83d7b65f65592b85ced07c

SHA256
07ee4c20f4bbc47cec3d5191dd720fcf0ab720344c9fa849f1ab44462cde35f5

SHA512
4b65b96bf046dc810f1286330c1cd962eae7cf0cd4d5d18b7f8287468f8cc4377dcc8796d5bd15521a06498864948e7cfbfcc0ca067a65c25b1ffce48b3f62f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat

Filesize
194B

MD5
b13481e16ab5c51fd84a90a7a1443a76

SHA1
b80412a7b94dc890c81eed58c8f42ff4b3fd6e09

SHA256
29f9bc121a01885cf840161ba1855bd58f8b4e7b6350f67c8b204cf2a6d4fa7c

SHA512
bb59489b74f22fea7ffafd8a123f8fdf9462379cb3b91b1575651cf98d5d18425abdfedf9f8e54dafc8f313b8de1b1e702fcf5d647ad27b6d8e96a6b249ea279

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9495efb6c323a5d1122d8a5ee31ee640

SHA1
5799b37bfa87e9836380d9c8f0f5cc70057b3406

SHA256
eb9ee180ca256e4fc1de02e06fc9ce0a4e7aa47780a3642fea6c117480fff464

SHA512
ef7136de7b45bfcb65fbe22491e0bb7f06e82f1b11c32e4583cb4b08db0abd34bf0c6663c37c94fffa5fbaf306f0c2367bc3d64bf65e5608a61a0172172489fd

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/704-215-0x0000000001230000-0x0000000001340000-memory.dmp

Filesize
1.1MB

Download
memory/1016-514-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/2140-634-0x00000000012D0000-0x00000000013E0000-memory.dmp

Filesize
1.1MB

Download
memory/2220-574-0x0000000000B90000-0x0000000000CA0000-memory.dmp

Filesize
1.1MB

Download
memory/2368-454-0x0000000000360000-0x0000000000470000-memory.dmp

Filesize
1.1MB

Download
memory/2528-71-0x0000000000310000-0x0000000000420000-memory.dmp

Filesize
1.1MB

Download
memory/2576-394-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2648-15-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2648-16-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/2648-17-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2648-14-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2648-13-0x0000000000920000-0x0000000000A30000-memory.dmp

Filesize
1.1MB

Download
memory/2704-63-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2704-65-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/2940-334-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download