dcrat | 320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe
Size

1.3MB
MD5

5e9865e20474b8fd61f20189345475d2
SHA1

d9dfd15f965e3f952e5c48e2bbb87d846f4b5577
SHA256

320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1
SHA512

b92ebf8be22bed371274023d711de705d912c013a51089cc4bfcdf9a83ed8e2ea96b04da46686b698c6dad881cdd03a1d1328a3d9ad8f7b63f00197858250c01
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	580	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2836	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2836	schtasks.exe	34

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d66-9.dat	dcrat
behavioral1/memory/1244-13-0x0000000000DB0000-0x0000000000EC0000-memory.dmp	dcrat
behavioral1/memory/1972-62-0x0000000000C50000-0x0000000000D60000-memory.dmp	dcrat
behavioral1/memory/2716-327-0x0000000000FA0000-0x00000000010B0000-memory.dmp	dcrat
behavioral1/memory/2248-447-0x0000000001190000-0x00000000012A0000-memory.dmp	dcrat
behavioral1/memory/1856-686-0x0000000001230000-0x0000000001340000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2544	powershell.exe
2264	powershell.exe
2876	powershell.exe
2636	powershell.exe
1700	powershell.exe
1748	powershell.exe
2344	powershell.exe
2716	powershell.exe
2736	powershell.exe
1128	powershell.exe
2776	powershell.exe
2732	powershell.exe
2880	powershell.exe
3044	powershell.exe
2468	powershell.exe
1428	powershell.exe
2916	powershell.exe
2160	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1244	DllCommonsvc.exe
1972	sppsvc.exe
1756	sppsvc.exe
1280	sppsvc.exe
2716	sppsvc.exe
760	sppsvc.exe
2248	sppsvc.exe
2512	sppsvc.exe
2900	sppsvc.exe
2004	sppsvc.exe
1856	sppsvc.exe
1928	sppsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2044	cmd.exe
2044	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
12	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
19	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\ja-JP\sppsvc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\42af1c969fbb7b	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ja-JP\0a1fd5f707cd16	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\audiodg.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\services.exe	DllCommonsvc.exe
File created	C:\Windows\IME\IMETC10\HELP\dwm.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\IME\IMETC10\HELP\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\IME\IMETC10\HELP\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Migration\WTR\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\servicing\de-DE\smss.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2124	schtasks.exe
2872	schtasks.exe
1240	schtasks.exe
2108	schtasks.exe
1788	schtasks.exe
908	schtasks.exe
1536	schtasks.exe
2192	schtasks.exe
1584	schtasks.exe
3024	schtasks.exe
2532	schtasks.exe
1004	schtasks.exe
2236	schtasks.exe
1728	schtasks.exe
2484	schtasks.exe
1340	schtasks.exe
408	schtasks.exe
2408	schtasks.exe
2952	schtasks.exe
2248	schtasks.exe
2252	schtasks.exe
2752	schtasks.exe
2200	schtasks.exe
1976	schtasks.exe
632	schtasks.exe
1784	schtasks.exe
2036	schtasks.exe
2016	schtasks.exe
2948	schtasks.exe
624	schtasks.exe
2140	schtasks.exe
1596	schtasks.exe
564	schtasks.exe
1732	schtasks.exe
1716	schtasks.exe
988	schtasks.exe
2228	schtasks.exe
1812	schtasks.exe
2384	schtasks.exe
1692	schtasks.exe
2908	schtasks.exe
2672	schtasks.exe
1628	schtasks.exe
2892	schtasks.exe
1600	schtasks.exe
1772	schtasks.exe
580	schtasks.exe
3056	schtasks.exe
1968	schtasks.exe
2276	schtasks.exe
1932	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 10 IoCs

pid	Process
1756	sppsvc.exe
1280	sppsvc.exe
2716	sppsvc.exe
760	sppsvc.exe
2248	sppsvc.exe
2512	sppsvc.exe
2900	sppsvc.exe
2004	sppsvc.exe
1856	sppsvc.exe
1928	sppsvc.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1244	DllCommonsvc.exe
1700	powershell.exe
2468	powershell.exe
2636	powershell.exe
2876	powershell.exe
3044	powershell.exe
2160	powershell.exe
2736	powershell.exe
2264	powershell.exe
1428	powershell.exe
2716	powershell.exe
1128	powershell.exe
1972	sppsvc.exe
2776	powershell.exe
2344	powershell.exe
2916	powershell.exe
2732	powershell.exe
1748	powershell.exe
2880	powershell.exe
2544	powershell.exe
1756	sppsvc.exe
1280	sppsvc.exe
2716	sppsvc.exe
760	sppsvc.exe
2248	sppsvc.exe
2512	sppsvc.exe
2900	sppsvc.exe
2004	sppsvc.exe
1856	sppsvc.exe
1928	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	DllCommonsvc.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	1972	sppsvc.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	1756	sppsvc.exe
Token: SeDebugPrivilege	1280	sppsvc.exe
Token: SeDebugPrivilege	2716	sppsvc.exe
Token: SeDebugPrivilege	760	sppsvc.exe
Token: SeDebugPrivilege	2248	sppsvc.exe
Token: SeDebugPrivilege	2512	sppsvc.exe
Token: SeDebugPrivilege	2900	sppsvc.exe
Token: SeDebugPrivilege	2004	sppsvc.exe
Token: SeDebugPrivilege	1856	sppsvc.exe
Token: SeDebugPrivilege	1928	sppsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1480	3052	JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe	30
PID 3052 wrote to memory of 1480	3052	JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe	30
PID 3052 wrote to memory of 1480	3052	JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe	30
PID 3052 wrote to memory of 1480	3052	JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe	30
PID 1480 wrote to memory of 2044	1480	WScript.exe	31
PID 1480 wrote to memory of 2044	1480	WScript.exe	31
PID 1480 wrote to memory of 2044	1480	WScript.exe	31
PID 1480 wrote to memory of 2044	1480	WScript.exe	31
PID 2044 wrote to memory of 1244	2044	cmd.exe	33
PID 2044 wrote to memory of 1244	2044	cmd.exe	33
PID 2044 wrote to memory of 1244	2044	cmd.exe	33
PID 2044 wrote to memory of 1244	2044	cmd.exe	33
PID 1244 wrote to memory of 2468	1244	DllCommonsvc.exe	86
PID 1244 wrote to memory of 2468	1244	DllCommonsvc.exe	86
PID 1244 wrote to memory of 2468	1244	DllCommonsvc.exe	86
PID 1244 wrote to memory of 2160	1244	DllCommonsvc.exe	87
PID 1244 wrote to memory of 2160	1244	DllCommonsvc.exe	87
PID 1244 wrote to memory of 2160	1244	DllCommonsvc.exe	87
PID 1244 wrote to memory of 3044	1244	DllCommonsvc.exe	89
PID 1244 wrote to memory of 3044	1244	DllCommonsvc.exe	89
PID 1244 wrote to memory of 3044	1244	DllCommonsvc.exe	89
PID 1244 wrote to memory of 1428	1244	DllCommonsvc.exe	90
PID 1244 wrote to memory of 1428	1244	DllCommonsvc.exe	90
PID 1244 wrote to memory of 1428	1244	DllCommonsvc.exe	90
PID 1244 wrote to memory of 2344	1244	DllCommonsvc.exe	91
PID 1244 wrote to memory of 2344	1244	DllCommonsvc.exe	91
PID 1244 wrote to memory of 2344	1244	DllCommonsvc.exe	91
PID 1244 wrote to memory of 2544	1244	DllCommonsvc.exe	92
PID 1244 wrote to memory of 2544	1244	DllCommonsvc.exe	92
PID 1244 wrote to memory of 2544	1244	DllCommonsvc.exe	92
PID 1244 wrote to memory of 2264	1244	DllCommonsvc.exe	93
PID 1244 wrote to memory of 2264	1244	DllCommonsvc.exe	93
PID 1244 wrote to memory of 2264	1244	DllCommonsvc.exe	93
PID 1244 wrote to memory of 1748	1244	DllCommonsvc.exe	95
PID 1244 wrote to memory of 1748	1244	DllCommonsvc.exe	95
PID 1244 wrote to memory of 1748	1244	DllCommonsvc.exe	95
PID 1244 wrote to memory of 1700	1244	DllCommonsvc.exe	97
PID 1244 wrote to memory of 1700	1244	DllCommonsvc.exe	97
PID 1244 wrote to memory of 1700	1244	DllCommonsvc.exe	97
PID 1244 wrote to memory of 1128	1244	DllCommonsvc.exe	98
PID 1244 wrote to memory of 1128	1244	DllCommonsvc.exe	98
PID 1244 wrote to memory of 1128	1244	DllCommonsvc.exe	98
PID 1244 wrote to memory of 2916	1244	DllCommonsvc.exe	99
PID 1244 wrote to memory of 2916	1244	DllCommonsvc.exe	99
PID 1244 wrote to memory of 2916	1244	DllCommonsvc.exe	99
PID 1244 wrote to memory of 2736	1244	DllCommonsvc.exe	100
PID 1244 wrote to memory of 2736	1244	DllCommonsvc.exe	100
PID 1244 wrote to memory of 2736	1244	DllCommonsvc.exe	100
PID 1244 wrote to memory of 2732	1244	DllCommonsvc.exe	101
PID 1244 wrote to memory of 2732	1244	DllCommonsvc.exe	101
PID 1244 wrote to memory of 2732	1244	DllCommonsvc.exe	101
PID 1244 wrote to memory of 2776	1244	DllCommonsvc.exe	102
PID 1244 wrote to memory of 2776	1244	DllCommonsvc.exe	102
PID 1244 wrote to memory of 2776	1244	DllCommonsvc.exe	102
PID 1244 wrote to memory of 2636	1244	DllCommonsvc.exe	104
PID 1244 wrote to memory of 2636	1244	DllCommonsvc.exe	104
PID 1244 wrote to memory of 2636	1244	DllCommonsvc.exe	104
PID 1244 wrote to memory of 2880	1244	DllCommonsvc.exe	105
PID 1244 wrote to memory of 2880	1244	DllCommonsvc.exe	105
PID 1244 wrote to memory of 2880	1244	DllCommonsvc.exe	105
PID 1244 wrote to memory of 2876	1244	DllCommonsvc.exe	107
PID 1244 wrote to memory of 2876	1244	DllCommonsvc.exe	107
PID 1244 wrote to memory of 2876	1244	DllCommonsvc.exe	107
PID 1244 wrote to memory of 2716	1244	DllCommonsvc.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_320964491c052392f40ff227f83a556095a2162408e223ea1a83643da4cabff1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\IMETC10\HELP\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\ja-JP\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Videos\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\es-ES\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1972
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat"
        6⤵
        
        PID:1308
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2128
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat"
        8⤵
        
        PID:2232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3044
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1JZ2DT5CuV.bat"
        10⤵
        
        PID:2512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1924
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5eI0Zh92hY.bat"
        12⤵
        
        PID:2940
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1340
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"
        14⤵
        
        PID:1640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:992
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat"
        16⤵
        
        PID:2156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:988
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat"
        18⤵
        
        PID:2672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2380
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat"
        20⤵
        
        PID:2464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2408
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat"
        22⤵
        
        PID:2260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:568
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        23⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat"
        24⤵
        
        PID:1080
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2300
        
        C:\Program Files\Windows Mail\ja-JP\sppsvc.exe
        
        "C:\Program Files\Windows Mail\ja-JP\sppsvc.exe"
        25⤵
        Executes dropped EXE
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\IMETC10\HELP\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\IME\IMETC10\HELP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMETC10\HELP\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\ja-JP\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\ja-JP\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\providercommon\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\providercommon\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\Videos\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Videos\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\providercommon\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85d8ee4a7007bcb5058fea925039137c

SHA1
7ccb5791d12742b07ebfb92049b416e557b30caf

SHA256
5fed51dacb9215cff2c3de8a58888e53605a97378e32ef3869a012063d208dcc

SHA512
b3cfdb33a74613aae7835d2ff88db047857cf99cbc952a36ea7e6c0c344d8e3ca3404dc63f4adf64e26aef55a07a598b0dfa01fa0509e90ecf1c8726ff85994c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfd130e0ad5bde7e2e2123b88f6b2425

SHA1
d616383ed46a06aed0fe405255dfc0d7707722bc

SHA256
779634a9e49e9c6b0f9705d53e0e698087a37d85db3c413ac8f587291be0c207

SHA512
334dd6f3a22cde94c0f4800011172af59ea7abea5ce012407463ecd907d7e1445234c44fd75210f132af5df5dece0216563a08dbce824ac1acf80ac34bce35a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
075a6c6a794940d0bfdb74eac11f928b

SHA1
62a5dcf766a02c225ac5991c7728d59a1e469873

SHA256
ae47382bcaa2a402c94764443d10fcb650ef8b837874f190f57cc126c6cdc34b

SHA512
22b2b8b6c9c723af8dd56a10ab2c6e808aaa5e2a18afe0c3ca3d304480dea61b9667cedef3f9b0e6a5c8947cc18446253330acc5f540d3099e8f160712dfa801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
233992bfa2ea091b8b74bf73917e8f65

SHA1
a2a1203907ca81428d8d07728891b2c5746be264

SHA256
973530fed0f7b1eb9bffdfcedeeb592c926057523abd556fd077ebceffe572d3

SHA512
76152b3e44d8b6bbf733c76ec7aedd1a60beec4a1bdb3b359084e1887defea6109a257841980de77d422aa4fd362ed28073b66da0bacbfc2bf3c644a1561f2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a31eb1f3f46f206ea1054ae3cd84524

SHA1
a5cd052db0bcec6df048cbd96593d9d650bc37d9

SHA256
e133d2ad66c90ca88eadbefb2fb43d3d588b41c5be0b452b004448c708cda603

SHA512
f23fb326a39db8d10addbd168b742cb63f221c634c0800a033b00ccaeb71ee1f70123432dc2884cab07aba210118dfb3af518842c14cb5404da511abbf1d780c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fe74922bfc8add52358fc54d4bc9158

SHA1
68aab8749a7e76a840f9e7c71798f22be821e1b8

SHA256
fed984abbe8b420eb982787711b9a01c7096cae3127597fb9bd4f0bc447af31a

SHA512
b209bbe81e169622a6b06d9932edd7302fb3370cd6900a7467be00ac81eae0f229839d04bfd28886513697a4ec8bb4f1736efb3549832273f0c1abe5703ee03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be83800c80be763f0520f10ad34a3e85

SHA1
44fd953287170ffe532fc0df7639997e656c00d0

SHA256
13ee6ae30d001caa6a3608f101762d2d91924e6555aa0c76bcb02a00bd0b0782

SHA512
e3caa8642e0b9a540bdb36c67b5edcd4676b04fc427bcf238b0c6925c0812b2834b81db4f344579dca91e0d2da0b175c9ea2d9994465dd6c0e540bfec83b27fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12f513ad1ecc79eb7e6e65ec357c76ff

SHA1
bc76bd607896963c9fb18e11f68d9fbf75bfae27

SHA256
7a12551493e01a59371f454ea04b3cf27b04659132f80f6e908c99f8b693550e

SHA512
932763d6926afad7955953b2282df2c60c71282754eab4f0792cadb6773f2d868882fb4bcf5942f07cccd2be038ec26b150007d34f956d0d9035c11f2ca57609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75ddec0ec443dab00f00960d3252d871

SHA1
34138ef392491eb7edb6aa72756998972b7cc416

SHA256
539c77d459ab766bac37915010c6eedbbe8748a6d2c32ce9cc72391e341ccf2b

SHA512
5c278cf693a07a0f252c835be1af22b37fd1e8cc23acabf91259603c3c137eff7c0be4d26494ac4f4f913c79e1a2b8d844187d1ccd17955c4c21708ed9d759e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1JZ2DT5CuV.bat

Filesize
211B

MD5
d538e4f2b9f8dbd4ecc3189068d57749

SHA1
b6539140c95d0f307e4b733789953a2edaa98ec2

SHA256
154966aea746d9753a4ec847f73fa62533050a3e09bdcedab34dec9a659e6c7f

SHA512
582423530e9c8198cd1d810c4e652d58566516dfcfc414173fa6b90a41d1be0f61eb962437ded43df6ed4c413721873868e828c3f92198beeca30dfb8c39c758

Download Submit
C:\Users\Admin\AppData\Local\Temp\5eI0Zh92hY.bat

Filesize
211B

MD5
084e3ed8c993f39b9ebb1a41b1971eb4

SHA1
9f4a10b811a89266c91bb6bc848c886e5d03de9c

SHA256
8eaf8e2cec0346be429acfd28e93a42205af0fb59718319e7eeb431681733bb3

SHA512
6046c744c206ba0ceaa25958f6679970f6f8b797344bbd9972617b7d47c126736c5148a390cbbac3e94d951431d9e4dc2a210893b92a4e507e8b70b0ecc0eec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat

Filesize
211B

MD5
d9296e8e4d2d710376332e2d27293ccc

SHA1
d76da2196739eacfa58253b70c25d0db94d29c30

SHA256
2788998931e51bbf83233879cdfe4da06b07c517f736d575c736211167bb7b66

SHA512
05cd98511c17d3a6526536b1a1788d0a0d1a43c47d1a497e0de301daaf7915800cb9e2db15df55863fb23c5fbdb83ce54fc058ccc13f75f46570f9be53e585b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat

Filesize
211B

MD5
92ba15ee9cf67368197815d11ebe67e3

SHA1
a4b13299d55529f32a9c6e854c303a8ef135102e

SHA256
d87df586261727af0a77a908bf03d072b3185d2ec25eb581bb527d92938db2ce

SHA512
29c9cd14e4ce3e1ecd907441e07c6c7862ad9394b6b775a703bf36f56565748f115994f6eb7c4e720b68f2788a9b1d5767656a4d685599804f55830327f7532b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE35F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2zd9hDRps.bat

Filesize
211B

MD5
204748920a84bcac1d8249c53277e0be

SHA1
0faf0610bd0d163778246e7588a78419181b5bea

SHA256
cb3d800fb4f6cec590b59789e52e1db1f27a53f661a30bc1ab31dd680581d446

SHA512
15c561a97e8648d7a32757b2fae40a5feed56c22af7d70551ebc1482601ff429e3e85d4bb537c3e47af24cc2169fbef367d26fd4b7fe92d4c5143a782f792cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IrGY9odMle.bat

Filesize
211B

MD5
d4c1bbf557fa51c71f01fae0f0b69e54

SHA1
7ed4a0ac2abb8013e1a7857f4c191664a87352c4

SHA256
04f50925d0c1de3fbc2e8b964609e813659fff5654976047fe1833f91e76e0a4

SHA512
a6414cbbd0a2fa3e0fbbbd1e14a4665dfb98b4618a1cc1d3fe427d91a03276fff8687dee5d69e75cee020b4fc3469631b91aba5c4955e09924532a66610687f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\R5wNYqVH5b.bat

Filesize
211B

MD5
d599f94a5fdaeeb81d5ff3f686fee63e

SHA1
c2996e00aac68e93013b2211ea62b5940528e370

SHA256
f7b06513489df55fa39b185b86e25165346eb849fde737cf5ee7ef5c449383c1

SHA512
fba1b3570e46e1030c116dd476dce4267aa80c8d8a007293bb98c73d1ef301f633d3e67618224989930491427ead29aaa119e98e863917a3fe79079b8d51e0e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE381.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat

Filesize
211B

MD5
fb6b6a195ad4b016d76ef71263def330

SHA1
9619ea1223f0c9049de57c76d19b16b911d7a1eb

SHA256
3a9fc5f6a7e835e8842854e66a3d29363dcb3b625c429dac74e2a1e216a5da88

SHA512
e8b6bc7e060eda8ef76e02a0a0b93a266ee8f6d8bf363607baabba414283c274b636cf2df06847b3a10a8b1dbc8b27069eae1c147e360bc4a972b1d04913f3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\uMS4yFj28m.bat

Filesize
211B

MD5
5320e32267e7d0f0628791caa14feb25

SHA1
b84f9746bf5979bbf9353c058a42a5c5d6fcf39d

SHA256
a23a0ae865987744f14c43196a48534f3f7cf52142d918885c695c9bca353489

SHA512
dec722d23e3bacc9d7ebf7297e041a486bd14c6775ee7f540b071be178786533f4b993993b502d12077ed6d28afe223eeac4c58662e13ae858e5f147debce00d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yoQf8QHV2Q.bat

Filesize
211B

MD5
4af8dd5e11292b6b69c6fb97c0c276fb

SHA1
54a9ec573c84cf9b6837c78f0137844cf8680fbc

SHA256
5653aeefa99f1dcd36574b773a4fa95efc92ea65a1e4f78d0004c3e6a18593f3

SHA512
cdde61eda57efd6b4dab22f2ac7489f5fa4d79572536a62a9af9820c190b0d8629a410f4b84b944b65984ff17aab56d642bd19db07fe3e85b1a2f5ea0a80419d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
71c7338c584c9c198c35959bf1b7900c

SHA1
744fe652ff40d1b3cd3df9e342a166e5418aa5f0

SHA256
3c5a476b1b7ccde335f50a6b3d955899853fac542625a4e3b1b552c3c41f9c18

SHA512
0fba62127df33df915d7a2a259eef504aa872c827aafa8dfc7707205bf1bfe7f6f61351bfa33dc3fe8a51c6566c14b6a289df41179a27acec077efb02c835ab6

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1244-17-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/1244-13-0x0000000000DB0000-0x0000000000EC0000-memory.dmp

Filesize
1.1MB

Download
memory/1244-14-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/1244-15-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/1244-16-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/1700-69-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/1700-68-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/1856-686-0x0000000001230000-0x0000000001340000-memory.dmp

Filesize
1.1MB

Download
memory/1972-121-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1972-62-0x0000000000C50000-0x0000000000D60000-memory.dmp

Filesize
1.1MB

Download
memory/2248-448-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2248-447-0x0000000001190000-0x00000000012A0000-memory.dmp

Filesize
1.1MB

Download
memory/2512-508-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/2716-328-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/2716-327-0x0000000000FA0000-0x00000000010B0000-memory.dmp

Filesize
1.1MB

Download